CVE Feed

    Dashboard / CVE / CVE-2026-35053

    CVE-2026-35053

    OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.

    Published:Apr 2, 2026
    Last Modified:Apr 14, 2026
    EPS:Apr 2, 2026
    EPSS Score:0.00115
    CVSS Score:9.8

    Affected Products

    Vendor
    Hackerbay
    Product
    Oneuptime
    Vendor
    Oneuptime
    Product
    Oneuptime

    Exploits

    https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7

    Related CVEs

    CVE-2026-80350 (CVSS 7.1) — OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of …
    CVE-2026-34840 (CVSS 8.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML …
    CVE-2026-34759 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notifica…
    CVE-2026-34758 (CVSS 9.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated a…
    CVE-2026-33396 (CVSS 9.9) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged …
    CVE-2026-33142 (CVSS 8.1) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE…
    CVE-2026-33143 (CVSS 8.7) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp PO…
    CVE-2026-32598 (CVSS 6.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow…
    CVE-2026-32308 (CVSS 7.6) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer com…
    CVE-2026-32306 (CVSS 9.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregati…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High