What’s Vulnerable › Vulnerabilities

CVE-2026-34759: OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-02 · updated 2026-10-06
• Weakness: CWE-862

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.

Affected products

• oneuptime: before 10.0.42 — fixed in 10.0.42

How to fix

Upgrade to a fixed version: oneuptime 10.0.42. Check the vendor advisory for mitigations.

References

• https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.42
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6wc5-rhvj-cx7f

Get alerted when CVE-2026-34759 or the next vulnerability affects your stack