Description Summary:
OneUptime is vulnerable to a sandbox escape in its Node.js environment due to the improper use of the vm module.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows for remote code execution by bypassing the Node.js vm module isolation.

Vulnerability Details

CVE-ID: CVE-2026-45102

Affected Software: OneUptime OneUptime

Affected Versions: Prior to 10.0.98

Vulnerability: The application utilizes the Node.js vm module for code isolation, which is not designed for security; attackers can escape this sandbox via error objects and recursion.

Business Impact

With a CVSS score of 9.9, this vulnerability permits an attacker to escape the intended execution environment and perform arbitrary code execution on the host. This poses a critical threat to the security and stability of the OneUptime platform.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.98 or later to remediate the sandbox escape vulnerability.

Proactive Monitoring: Monitor for abnormal system calls or unauthorized filesystem access originating from the OneUptime application process.

Compensating Controls: Run the application with restricted OS-level permissions (e.g., using containers or sandboxing technologies) to mitigate the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The use of the vm module for security isolation is inherently flawed. Administrators must update to the latest version immediately to ensure that more robust security primitives are in place.

Description Summary:
OneUptime, an open-source monitoring and observability platform, contains a vulnerability that could impact the security of its monitoring environment.

Executive Summary:
A high-severity flaw in the OneUptime platform could allow unauthorized actors to compromise observability data or gain unauthorized access to monitoring configurations.

Vulnerability Details

CVE-ID: CVE-2026-34840

Affected Software: OneUptime OneUptime

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the core OneUptime observability platform. While the specific function is not detailed, the high CVSS score suggests a critical failure in access control or input handling, potentially accessible by unauthenticated remote attackers.

Business Impact

Compromise of an observability platform is a critical risk, as it provides attackers with visibility into the entire infrastructure's health and potential weaknesses. A CVSS score of 8.1 reflects the high potential for unauthorized access and data exfiltration. This could lead to a loss of trust in system monitoring and delayed responses to legitimate outages.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the OneUptime project to secure the monitoring environment.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or anomalous access patterns originating from unknown IP addresses.

Compensating Controls: Restrict access to the OneUptime dashboard and API using network-level access control lists (ACLs) or a VPN to limit exposure to trusted users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Given the platform's role in infrastructure management, it is a high-value target for sophisticated threat actors.

Analyst Recommendation

Immediate patching is required to protect the integrity of your observability stack. Given the CVSS score of 8.1, this should be treated as a priority remediation task to prevent attackers from gaining a "god's eye view" of your network operations.

Description Summary:
Unauthenticated access to notification and phone management endpoints in OneUptime allows attackers to abuse communication services and perform unauthorized purchases.

Executive Summary:
OneUptime versions prior to 10.0.42 are vulnerable to unauthenticated access, allowing attackers to hijack communication channels and incur unauthorized financial costs.

Vulnerability Details

CVE-ID: CVE-2026-34758

Affected Software: OneUptime Monitoring and Observability Platform

Affected Versions: Prior to version 10.0.42

Vulnerability: The software fails to enforce authentication on Notification test and Phone Number management endpoints. This allows an unauthenticated remote attacker to abuse SMS, Call, Email, and WhatsApp services, as well as purchase phone numbers through the platform's integrated services.

Business Impact

Exploitation of this flaw can result in significant financial loss due to unauthorized service consumption and phone number purchases. Additionally, attackers can leverage the platform to send fraudulent communications, leading to reputational damage and potential use of the system in phishing or spam campaigns. The CVSS score of 9.1 underscores the critical nature of this unauthorized access.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.42 or later to apply the necessary authentication checks on vulnerable endpoints.

Proactive Monitoring: Monitor communication logs for spikes in SMS or call volume and review billing statements for unauthorized charges related to phone number management.

Compensating Controls: Restrict network access to the OneUptime management interface and implement rate-limiting on notification endpoints to mitigate the impact of automated abuse.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation of this vulnerability. The vulnerability is particularly dangerous because it requires no authentication to trigger service abuse.

Analyst Recommendation

Organizations using OneUptime must upgrade to version 10.0.42 immediately to close these exposed endpoints. Because this flaw directly impacts financial resources and communication integrity, rapid remediation is essential to prevent both monetary loss and brand damage.

Description Summary:
OneUptime versions prior to 10.0.35 allow low-privileged users to achieve remote code execution on the Probe container by escaping the Playwright sandbox via unblocked internal properties.

Executive Summary:
A critical sandbox escape in OneUptime allows authenticated, low-privileged users to execute arbitrary commands on the underlying host or container by abusing the Synthetic Monitor feature.

Vulnerability Details

CVE-ID: CVE-2026-33396

Affected Software: OneUptime

Affected Versions: Versions prior to 10.0.35

Vulnerability: The vulnerability involves an incomplete denylist in the VMRunner.runCodeInNodeVM sandbox. A low-privileged authenticated user (ProjectMember) can use a live Playwright page object to traverse to _browserType.launchServer, allowing them to spawn arbitrary processes outside the intended sandbox.

Business Impact

This vulnerability facilitates lateral movement and full container compromise from a low-privileged account. With a CVSS score of 9.9, the impact is severe, potentially leading to the theft of monitoring data, credential harvesting from the host, and disruption of observability services.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.35 or higher to apply the corrected sandbox restrictions.

Proactive Monitoring: Audit Synthetic Monitor scripts for any use of internal Playwright properties or attempts to access the browser() or context() methods in ways that deviate from standard monitoring.

Compensating Controls: Implement strict container escape protections, such as AppArmor or SELinux profiles, and ensure the Probe containers run with the least possible privileges on the host.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to execute code on the infrastructure represents a significant insider threat and lateral movement risk. Application of the 10.0.35 patch is critical to restoring the integrity of the script execution sandbox.

Description Summary:
OneUptime, an observability and management solution, is affected by a high-severity vulnerability that could compromise monitoring data and system availability.

Executive Summary:
A security vulnerability in OneUptime could allow attackers to disrupt service monitoring and gain unauthorized access to critical infrastructure management tools.

Vulnerability Details

CVE-ID: CVE-2026-33142

Affected Software: OneUptime

Affected Versions: See vendor advisory for affected versions

Vulnerability: OneUptime is affected by a flaw in its monitoring or management modules. The CVSS score of 8.1 suggests a high-impact vulnerability, such as unauthorized administrative access or the ability to execute arbitrary commands, which could be exploited to blind security teams or disrupt managed services.

Business Impact

An attacker could exploit this vulnerability to hide malicious activity from monitoring tools, trigger false alerts, or take control of the management interface to shut down critical services. This poses a high risk to operational continuity and the overall security posture of the organization.

Remediation Plan

Immediate Action: Update OneUptime to the latest version immediately and rotate any credentials used by the platform to monitor external services.

Proactive Monitoring: Monitor for unauthorized changes to monitoring configurations and review access logs for administrative accounts.

Compensating Controls: Restrict access to the OneUptime management interface to a secure VPN or trusted IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, management platforms are high-value targets for attackers seeking to maintain persistence.

Analyst Recommendation

Organizations should prioritize patching OneUptime to prevent attackers from compromising their primary monitoring and response platform. Ensuring the security of observability tools is vital for maintaining visibility into the rest of the IT environment.

Description Summary:
OneUptime, an observability and monitoring platform, contains a vulnerability that could allow attackers to interfere with service monitoring or access sensitive configuration data.

Executive Summary:
A high-severity vulnerability in the OneUptime monitoring platform could allow an attacker to compromise the visibility and integrity of critical online services.

Vulnerability Details

CVE-ID: CVE-2026-32308

Affected Software: OneUptime

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the OneUptime solution, a platform designed for managing service uptime. The flaw likely allows an attacker to bypass standard access controls to view or modify monitoring configurations, potentially masking service outages or intercepting alert data.

Business Impact

The CVSS score of 7.6 indicates a high-risk scenario where the reliability of an organization's monitoring infrastructure is compromised. An exploit could lead to undetected downtime, loss of operational visibility, and the exposure of infrastructure metadata, causing significant reputational and financial damage.

Remediation Plan

Immediate Action: Immediately update the OneUptime platform to the latest available version to address the identified security flaw.

Proactive Monitoring: Audit user activity logs within the OneUptime dashboard for unauthorized configuration changes or unusual administrative logins.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic to the OneUptime management interface and implement multi-factor authentication (MFA) for all users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, the importance of monitoring tools makes them high-value targets for attackers seeking to hide their tracks.

Analyst Recommendation

Organizations relying on OneUptime for operational visibility must treat this vulnerability as a high priority. Apply the vendor-provided security updates immediately to ensure the continued integrity of your monitoring and alerting pipeline.

Description Summary:
OneUptime versions prior to 10.0.23 are vulnerable to SQL injection in the telemetry aggregation API due to improper interpolation of user-controlled parameters into ClickHouse queries.

Executive Summary:
An authenticated attacker can execute arbitrary SQL queries within ClickHouse, leading to full database compromise and potential remote code execution in OneUptime environments.

Vulnerability Details

CVE-ID: CVE-2026-32306

Affected Software: OneUptime

Affected Versions: Prior to 10.0.23

Vulnerability: This vulnerability involves a SQL injection flaw where the telemetry aggregation API accepts unsanitized parameters and appends them directly to ClickHouse SQL queries. An authenticated user can bypass intended query logic to perform unauthorized data modifications or read sensitive telemetry data across all tenants.

Business Impact

A successful exploit poses a critical risk to data confidentiality and integrity, as an attacker could gain access to sensitive telemetry data belonging to all system tenants. Given the CVSS score of 9.9, the impact is severe, potentially allowing for remote code execution via ClickHouse table functions and total system takeover. This could result in significant service disruption and loss of customer trust.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.23 or later immediately to apply necessary input validation and parameterized query bindings.

Proactive Monitoring: Review ClickHouse logs for unusual query patterns, specifically those involving the .append() method or unexpected table function calls.

Compensating Controls: Implement strict network-level access controls to the ClickHouse interface and utilize a Web Application Firewall (WAF) to filter suspicious API parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the flaw and the ease of SQL injection, the potential for exploitation is extremely high for unpatched systems.

Analyst Recommendation

The severity of this SQL injection vulnerability cannot be overstated, as it grants deep access to the underlying data infrastructure. Organizations using OneUptime must prioritize the update to version 10.0.23 immediately. Failure to remediate this flaw exposes the entire telemetry dataset and the host environment to complete compromise.

Description Summary:
A server-side RCE vulnerability in OneUptime Synthetic Monitors allows low-privileged users to execute arbitrary commands by abusing exposed Playwright browser objects.

Executive Summary:
OneUptime is vulnerable to remote code execution because it exposes sensitive browser APIs to low-privileged users, allowing them to spawn malicious executables on the server.

Vulnerability Details

CVE-ID: CVE-2026-30957

Affected Software: OneUptime

Affected Versions: Prior to 10.0.21

Vulnerability: This vulnerability occurs because untrusted Synthetic Monitor code is executed while live host-realm Playwright browser and page objects remain exposed. A low-privileged authenticated project user can call Playwright APIs on these objects to cause the probe server to spawn an attacker-controlled executable, achieving server-side remote code execution without needing a sandbox escape.

Business Impact

With a CVSS score of 9.9, this vulnerability allows for the total compromise of the oneuptime-probe server. An attacker can execute arbitrary commands, potentially leading to data exfiltration, service disruption, and lateral movement within the hosting environment. This poses a severe risk to the integrity of the monitoring platform.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.21 or later to properly isolate Playwright objects from the user execution environment.

Proactive Monitoring: Monitor for unexpected process creation (e.g., shells or unknown binaries) originating from the oneuptime-probe container.

Compensating Controls: Use container security tools to enforce strict syscall filtering and prevent the spawning of unauthorized sub-processes within the application environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. The direct access to Playwright APIs makes this RCE significantly easier to execute than typical sandbox escapes.

Analyst Recommendation

This vulnerability represents a critical failure in the isolation of user-provided code. It is imperative that administrators apply the update to version 10.0.21 immediately. Organizations should also review the permissions of users allowed to create synthetic monitors.

Description Summary:
A critical authorization bypass in OneUptime allows low-privileged users to forge headers, escape tenant isolation, and achieve full account takeover of other users.

Executive Summary:
OneUptime is vulnerable to a multi-tenancy escape that allows low-privileged users to access other tenants' data and fully take over any user account via forged headers.

Vulnerability Details

CVE-ID: CVE-2026-30956

Affected Software: OneUptime

Affected Versions: Prior to 10.0.21

Vulnerability: This vulnerability stems from the server trusting client-supplied headers like is-multi-tenant-query and projectid. An authenticated low-privileged user can forge these headers to skip internal permission checks, disable tenant scoping, and access sensitive data belonging to other organizations, including plaintext password reset tokens, enabling full account takeover.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a total breakdown of the platform's security model. Attackers can leak sensitive user fields, reset victim passwords, and compromise the data of every tenant on the platform. This leads to massive data exposure and a complete loss of customer trust.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.21 or later to ensure the server correctly validates and enforces tenant isolation independently of client-supplied headers.

Proactive Monitoring: Audit access logs for the presence of the is-multi-tenant-query header and investigate any cross-project data access patterns.

Compensating Controls: Implement a reverse proxy or API gateway that strips or validates sensitive internal headers before they reach the application server.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. However, the simplicity of forging headers makes this an extremely high-risk vulnerability for any multi-tenant deployment.

Analyst Recommendation

This is a catastrophic flaw for any SaaS or multi-tenant installation of OneUptime. Immediate remediation via upgrading to version 10.0.21 is mandatory. Organizations must also consider a full audit of their data to ensure no unauthorized access occurred prior to patching.

Description Summary:
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitrary executables.

Executive Summary:
OneUptime’s Synthetic Monitors allow authenticated users to bypass normal execution limits and spawn arbitrary executables on the probe host via exposed Playwright objects.

Vulnerability Details

CVE-ID: CVE-2026-30921

Affected Software: OneUptime

Affected Versions: Prior to 10.0.20

Vulnerability: In OneUptime versions prior to 10.0.20, untrusted Playwright code is executed inside a Node.js vm but is provided with live host Playwright objects. This allows a low-privileged authenticated user to bypass sandbox restrictions by directly calling browser.browserType().launch() to spawn an arbitrary executable on the probe host or container.

Business Impact

This vulnerability carries a CVSS score of 9.9, indicating a near-total threat to the system. An attacker can achieve full remote code execution, allowing them to compromise the probe container, access sensitive environment variables, and potentially move laterally into the wider infrastructure.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.20 or later to ensure that Playwright objects are not exposed to the user-controlled execution environment.

Proactive Monitoring: Review synthetic monitor scripts for calls to launch() or other sensitive browser management functions and audit container processes for unauthorized binaries.

Compensating Controls: Restrict the privileges of the container running the oneuptime-probe and implement strict outbound network filtering to prevent command-and-control communication.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous because it provides a direct path to RCE without requiring complex sandbox escape techniques.

Analyst Recommendation

The ability for low-privileged users to execute arbitrary code on the server is a critical security failure. Administrators must upgrade to version 10.0.20 immediately to mitigate the risk of a full container and potentially cluster-wide compromise.

Description Summary:
OneUptime prior to 10.0.19 contains an authorization bypass vulnerability in its GitHub App callback, allowing unauthenticated attackers to overwrite project bindings and enumerate repositories.

Executive Summary:
A critical authorization bypass vulnerability in OneUptime allows unauthenticated attackers to manipulate GitHub App installation bindings and gain unauthorized access to project repository data.

Vulnerability Details

CVE-ID: CVE-2026-30920

Affected Software: OneUptime

Affected Versions: OneUptime < 10.0.19

Vulnerability: The application fails to validate the authorization of callers during the GitHub App callback process, allowing an unauthenticated attacker to inject controlled state and installation IDs. This results in the elevation of privileges, enabling the attacker to overwrite project bindings and enumerate sensitive repository information.

Business Impact

The exploitation of this vulnerability leads to significant security risks, including unauthorized access to internal project data and the potential for supply chain compromise through the manipulation of repository records. Given the CVSS score of 8.6, this flaw presents a high risk to organizational confidentiality and integrity, as it allows attackers to bypass core access controls without requiring prior authentication.

Remediation Plan

Immediate Action: Update the OneUptime instance to version 10.0.19 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review audit logs for suspicious GitHub App callback activities or unexpected modifications to Project GitHub App installation bindings.

Compensating Controls: Implement strict network access controls to limit access to the OneUptime web interface and utilize a Web Application Firewall to block suspicious callback requests targeting the vulnerable endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 12, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the high severity of this authorization bypass and the potential for unauthorized access to project repositories, organizations must prioritize upgrading to version 10.0.19. Failure to patch this vulnerability leaves the environment exposed to unauthorized configuration changes and data enumeration by any remote attacker.

Description Summary:
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code execution and full cluster compromise.

Executive Summary:
Authenticated users in OneUptime can escape the JavaScript sandbox to execute arbitrary system commands, leading to a complete compromise of the database and cluster credentials.

Vulnerability Details

CVE-ID: CVE-2026-30887

Affected Software: OneUptime

Affected Versions: Prior to 10.0.18

Vulnerability: The system executes custom Playwright/JavaScript code within an insecure Node.js vm module. An authenticated project member can leverage a standard prototype-chain escape to bypass this sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container.

Business Impact

The business impact is critical, as the affected container holds environment variables containing database and cluster credentials. Exploitation leads directly to a complete cluster compromise. With a CVSS score of 9.9, the risk involves total loss of data confidentiality, integrity, and availability across the entire monitoring infrastructure.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.18 or later to ensure untrusted code is executed in a secure, hardened environment.

Proactive Monitoring: Inspect synthetic monitor configurations for suspicious JavaScript or use of constructor escapes and review container logs for unauthorized shell activity.

Compensating Controls: Implement network segmentation to isolate the oneuptime-probe containers and restrict their access to sensitive internal databases and cluster APIs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the use of well-known sandbox escape techniques makes the likelihood of exploitation by a knowledgeable insider very high.

Analyst Recommendation

Given the potential for complete cluster takeover, this vulnerability must be addressed with extreme urgency. Organizations should upgrade to version 10.0.18 immediately. Until the patch is applied, restrict the ability of users to create or modify synthetic monitors.

Description Summary:
OneUptime versions 10.0.11 and prior contain a critical authentication bypass vulnerability due to improper WebAuthn challenge handling, allowing for replay attacks.

Executive Summary:
A vulnerability in the OneUptime WebAuthn implementation allows attackers to bypass second-factor authentication via replay attacks, posing a severe risk to account security.

Vulnerability Details

CVE-ID: CVE-2026-28787

Affected Software: OneUptime

Affected Versions: <= 10.0.11

Vulnerability: The application fails to store WebAuthn challenges server-side, instead returning them to the client and accepting them back during verification. This flaw allows an authenticated attacker to replay captured WebAuthn assertions indefinitely, effectively bypassing multi-factor authentication requirements.

Business Impact

This vulnerability carries a CVSS score of 8.2, representing a high risk to organizational security. Successful exploitation allows unauthorized parties to bypass critical second-factor authentication controls, potentially leading to full account takeover, unauthorized access to sensitive service management data, and significant reputational damage.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should prioritize implementing alternative authentication controls or restricting access to the affected management interfaces until a fix is released.

Proactive Monitoring: Review authentication logs for anomalous or repetitive WebAuthn login attempts and monitor for unusual traffic patterns originating from user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict unauthorized access to authentication endpoints and consider enforcing additional IP-based access controls to limit the surface area for potential replay attacks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it undermines the fundamental security guarantees of the WebAuthn standard by failing to validate challenge state on the server.

Analyst Recommendation

Given the lack of a vendor-provided patch and the presence of a known proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing OneUptime should immediately evaluate their risk exposure and implement compensating controls, such as limiting network access to the monitoring interface, while awaiting an official security update.

Description Summary:
An OS command injection vulnerability in OneUptime allows authenticated users to execute arbitrary commands on the Probe server via the monitor destination field.

Executive Summary:
Authenticated users can achieve full remote code execution on OneUptime Probe servers by exploiting a command injection vulnerability in the traceroute functionality.

Vulnerability Details

CVE-ID: CVE-2026-27728

Affected Software: OneUptime OneUptime

Affected Versions: Prior to version 10.0.7

Vulnerability: The vulnerability exists in the NetworkPathMonitor.performTraceroute() function, which fails to properly sanitize shell metacharacters in the destination field. This allows an authenticated project user to inject and execute arbitrary operating system commands on the underlying Probe server.

Business Impact

A successful exploit allows an attacker to take complete control of the Probe server, potentially using it as a pivot point to attack other internal network resources. This leads to a total loss of confidentiality, integrity, and availability for the affected monitoring infrastructure. The CVSS score of 9.9 reflects the critical risk of authenticated remote code execution.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.7 or later immediately to patch the command injection flaw.

Proactive Monitoring: Inspect Probe server logs for suspicious shell commands or unusual outbound network connections originating from the monitoring service.

Compensating Controls: Use containerization to isolate the Probe service and implement strict AppArmor or SELinux profiles to limit the commands the service can execute.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly mitigates the risk, but any compromised user account could be used to trigger the exploit.

Analyst Recommendation

Remote code execution vulnerabilities in monitoring tools are particularly dangerous as these tools often have broad network access. Immediate patching is required to secure the Probe servers and prevent lateral movement within the corporate network.

Description Summary:
A sandbox escape in OneUptime allows users with low privileges or anonymous access to execute arbitrary code and gain full access to cluster credentials and environment variables.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows unauthenticated or low-privileged users to achieve full cluster compromise and steal sensitive infrastructure credentials within seconds.

Vulnerability Details

CVE-ID: CVE-2026-27574

Affected Software: OneUptime

Affected Versions: 9.5.13 and below

Vulnerability: This vulnerability stems from the use of the insecure node:vm module for custom JavaScript monitoring, which permits a trivial sandbox escape. Exploitation is possible by unauthenticated users if open registration is enabled, or by users with the "ProjectMember" role.

Business Impact

A successful exploit grants an attacker full access to the underlying process and host networking. This results in the immediate exposure of critical secrets, including ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, and CLICKHOUSE_PASSWORD. Given the CVSS score of 9.9, this represents a total loss of confidentiality, integrity, and availability for the entire monitoring cluster.

Remediation Plan

Immediate Action: Administrators must upgrade OneUptime to version 10.0.5 or later immediately to resolve the insecure code execution path.

Proactive Monitoring: Review system environment logs and audit project member activity for any unauthorized custom JavaScript monitors created prior to patching.

Compensating Controls: Disable open registration and restrict the "ProjectMember" role's ability to create custom monitors until the environment is fully patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the trivial nature of the sandbox escape and the high-value credentials at risk, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path from low-privileged access to full infrastructure control. Organizations using OneUptime must prioritize the update to version 10.0.5 immediately to prevent catastrophic data breaches and system takeover.