Read the docs
TI-2026-25572 Aliases CVE-2026-33142GHSA-gcg3-c5p2-cqgg

OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns. ClickHouse Identifier parameters are substituted directly into queries without escaping, so an attacker who can reach any analytics list or aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. This issue has been patched in version 10.0.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed oneuptime (OneUptime): 10.0.34oneuptime (npm): 10.0.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OneUptimeoneuptimebefore 10.0.3410.0.34Patch availableCNA
—oneuptime (npm)before 10.0.3410.0.34Patch availableGHSA-gcg3-c5p2-cqgg
  • oneuptime VendorOneUptime Affected before 10.0.34 Fixed in 10.0.34 Patch available CNA
  • oneuptime (npm) Vendor— Affected before 10.0.34 Fixed in 10.0.34 Patch available GHSA-gcg3-c5p2-cqgg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*before 10.0.34VulnerableOneUptime
  • cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions before 10.0.34 Vulnerable ·OneUptime

Remediation

  • Fix · CNA oneuptime (OneUptime) Fixed in 10.0.34
  • Fix · GHSA-gcg3-c5p2-cqgg oneuptime (npm) Fixed in 10.0.34 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33142
  2. 2026-10-03 Alias added: GHSA-gcg3-c5p2-cqgg

References

Advisory 2

Other 1

  • TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
  • TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
  • TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
  • TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
  • TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences