TI-2026-76175 Aliases CVE-2026-112047 GHSA-j2m9-x4vf-qv28

Incorrect authorization in OneUptime Kubernetes AI actions

LOW 23CWE-863Published 2026-10-18 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

OneUptime versions from 14.0.2 before 14.0.69 contain an incorrect authorization flaw (CWE-863) in its Kubernetes AI features. Authenticated project members can act on clusters outside their scope because permission checks are made project-wide. An attacker with low privileges can view agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00177 7th percentileScored 2026-11-07

Fix Fixed oneuptime (OneUptime): 14.0.69

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OneUptime	oneuptime	14.0.2 to before 14.0.69	14.0.69	Patch available	CNA

oneuptime VendorOneUptime Affected 14.0.2 to before 14.0.69 Fixed in 14.0.69 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hackerbay:oneuptime::::::::	—	—	OneUptime

cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions — — ·OneUptime

Remediation

Upgrade OneUptime to version 14.0.69 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA oneuptime (OneUptime) Fixed in 14.0.69

Timeline

2026-10-18 Threatist record created from CVE-2026-112047
2026-10-18 Alias added: GHSA-j2m9-x4vf-qv28
2026-10-20 CISA SSVC decision points changed

References

Patch 1

https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452

Advisory 1

GitHub Security Advisory (GHSA-8fph-9j9f-xxgc)

Other 2

TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
TI-2026-32941 OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion CVSS 3.1CRITICAL 9.9
TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences