uptime-kuma vulnerabilities

CVEs whose affected-version data names the uptime-kuma package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119552Medium· 4.8

1w ago

Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcr…

▾ Sunlitlouislam · uptime-kumaEPSS 0.23%via CVEORG