CRITICAL🇵🇱 Wersja polska

CVE-2026-35053

CVSS 9.2v4.0pub. 2026-04-02upd. 2026-07-24

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The Worker service in OneUptime exposes ManualAPI endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. Anyone with network access to the service can call these endpoints by providing a workflow identifier and their own input data. As a result, the platform executes the JavaScript code associated with the given workflow and other configured actions with attacker-controlled input data.

Impact

An attacker can remotely execute JavaScript code (RCE) in the context of the Worker service, abuse notification mechanisms, and manipulate data processed by the monitoring platform.

Mitigation & patch

OneUptime should be updated to version 10.0.42 or newer, in which the issue has been patched. Details available in the official producer advisory: https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7

Who is affected

OneUptime (Hackerbay) in all versions prior to 10.0.42

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X