---
id: CVE-2026-119552
title: Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
summary: >-
  Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run
  setup handler that allows unauthenticated attackers to create an additional
  administrator account. Attackers can send concurrent setup requests during the
  bcr…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-367
vendor: louislam
product: uptime-kuma
affected:
  - uptime-kuma <= 2.5.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:04.753408Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:54:36.118Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119552'
references:
  - url: >-
      https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722
  - url: 'https://abraxaslabs.tech/research/uptime-kuma-setup-toctou'
  - url: 'https://github.com/louislam/uptime-kuma'
  - url: >-
      https://www.vulncheck.com/advisories/uptime-kuma-through-2.5.8-race-condition-admin-creation-via-setup-handler
    label: >-
      VulnCheck Advisory: Uptime Kuma through 2.5.8 Race Condition Admin
      Creation via Setup Handler
tags:
  - cve.org
epss: 0.00234
epssPercentile: 0.1435
ingestedAt: '2026-11-05T16:07:30.521Z'
---

## Overview

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.

## Affected

- `uptime-kuma <= 2.5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.