CVE-2026-35053Critical· 9.8▾ MidnightOneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.
oneuptime < 10.0.42Upgrade past the affected range:
oneuptime 10.0.42Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34758Critical· 9.1OneUptime is an open-source monitoring and observability platform
CVE-2026-34759High· 8.1OneUptime is an open-source monitoring and observability platform
CVE-2026-34840High· 8.1OneUptime is an open-source monitoring and observability platform
CVE-2026-112047Medium· 5.4OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
CVE-2026-33396Critical· 9.9OneUptime is an open-source monitoring and observability platform
CVE-2026-33142High· 8.1OneUptime is a solution for monitoring and managing online services