CVE-2026-34759High· 8.1▾ TwilightOneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.
oneuptime < 10.0.42Upgrade past the affected range:
oneuptime 10.0.42Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34758Critical· 9.1OneUptime is an open-source monitoring and observability platform
CVE-2026-30959Medium· 5.0OneUptime is a solution for monitoring and managing online services
CVE-2026-30956Critical· 9.9OneUptime is a solution for monitoring and managing online services
CVE-2026-35053Critical· 9.8OneUptime is an open-source monitoring and observability platform
CVE-2026-34840High· 8.1OneUptime is an open-source monitoring and observability platform
CVE-2026-112047Medium· 5.4OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions