OneUptime vulnerabilities

Products

• oneuptime 26
• @oneuptime/common 11
• @oneuptime/common-server 1
• @oneuptime/model 1

Latest OneUptime CVEs

Newest publication first · page 1 of 2

1. CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

   Published 2026-10-18

   Medium·CVSS 5.3 EPSS 0.18%

   OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approv...

2. CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

   Published 2026-08-26

   High·CVSS 7.1 EPSS 0.40%

   OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening ins...

3. CVE-2026-45102 OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

   Published 2026-05-27

   Critical·CVSS 9.9 EPSS 0.27%

   OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10....

4. CVE-2026-35053 OneUptime: Unauthenticated Workflow Execution via ManualAPI

   Published 2026-04-02

   Critical·CVSS 9.2 EPSS 0.56%

   OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware....

5. CVE-2026-34840 OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification

   Published 2026-04-02

   High·CVSS 8.1 EPSS 0.27%

   OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature>...

6. CVE-2026-34759 OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure

   Published 2026-04-02

   Critical·CVSS 9.2 EPSS 0.61%

   OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServic...

7. CVE-2026-34758 OneUptime: Missing Authentication on Notification Endpoints

   Published 2026-04-02

   Critical·CVSS 9.1 EPSS 0.35%

   OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10...

8. CVE-2026-33396 OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

   Published 2026-03-26

   Critical·CVSS 10.0 EPSS 0.87%

   OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic mo...

9. CVE-2026-33142 OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

   Published 2026-03-20

   High·CVSS 8.1 EPSS 0.31%

   OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to thr...

10. CVE-2026-33143 OneUptime: WhatsApp Webhook Missing Signature Verification

    Published 2026-03-20

    High·CVSS 8.7 EPSS 0.19%

    OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowi...

11. CVE-2026-32598 OneUptime: Password Reset Token Logged at INFO Level

    Published 2026-03-12

    Medium·CVSS 6.9 EPSS 0.27%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to applica...

12. CVE-2026-32308 OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

    Published 2026-03-12

    High·CVSS 7.6 EPSS 0.26%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in M...

13. CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

    Published 2026-03-12

    Critical·CVSS 10.0 EPSS 0.74%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL quer...

14. CVE-2026-30959 OneUptime has WhatsApp Resend Verification Authorization Bypass

    Published 2026-03-10

    Medium·CVSS 5.3 EPSS 0.42%

    OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects...

15. CVE-2026-30958 OneUptime: Path Traversal — Arbitrary File Read (No Auth)

    Published 2026-03-10

    High·CVSS 8.6 EPSS 1.2%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated dire...

16. CVE-2026-30957 OneUptime Synthetic Monitor RCE via exposed Playwright browser object

    Published 2026-03-10

    Critical·CVSS 10.0 EPSS 1.3%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic...

17. CVE-2026-30956 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

    Published 2026-03-10

    Critical·CVSS 10.0 EPSS 0.55%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid heade...

18. CVE-2026-30921 OneUptime Synthetic Monitor RCE via exposed Playwright browser object

    Published 2026-03-09

    Critical·CVSS 10.0 EPSS 0.49%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted c...

19. CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

    Published 2026-03-09

    High·CVSS 8.6 EPSS 0.23%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is a...

20. CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

    Published 2026-03-09

    Critical·CVSS 10.0 EPSS 0.45%

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node...

21. CVE-2026-28787 OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

    Published 2026-03-06

    Critical·CVSS 9.0 EPSS 0.31%

    OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client reques...

22. CVE-2026-27728 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

    Published 2026-02-25

    High·CVSS 8.8 EPSS 2.0%

    OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server b...

23. CVE-2026-27574 OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

    Published 2026-02-21

    Critical·CVSS 10.0 EPSS 0.56%

    OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape vi...

24. CVE-2025-66028 OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

    Published 2025-11-26

    Medium·CVSS 6.9 EPSS 0.32%

    OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By interceptin...

25. CVE-2025-65966 OneUptime Unauthorized User Creation via API

    Published 2025-11-26

    High·CVSS 8.8 EPSS 0.33%

    OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.