What is the CVSS score of CVE-2026-29779?

CVE-2026-29779 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Uptimeflare are affected by CVE-2026-29779?

UptimeFlare instances may inadvertently expose sensitive server configuration data to client-side code, potentially allowing attackers to access credentials and internal settings.. A patch is available.

How to fix or mitigate CVE-2026-29779?

Within 24 hours: audit all UptimeFlare deployments to confirm version and exposure status; notify relevant stakeholders of potential exposure. Within 7 days: apply available patch (commit 377a596 or later) across all production and non-production instances; rotate any exposed credentials and API keys as precaution. Within 30 days: conduct log review for signs of unauthorized access; validate configuration separation in patched instances; implement code review process to prevent similar misconfigurations.

Uptimeflare CVE-2026-29779

HIGH

Information Exposure (CWE-200)

2026-03-07 security-advisories@github.com

Information Disclosure Uptimeflare

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 11, 2026 - 22:07 nvd

Patch available

CVE Published

Mar 07, 2026 - 16:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This issue has been patched via commit 377a596.

AnalysisAI

UptimeFlare's configuration management fails to segregate server-only sensitive data from client-side code, causing the workerConfig object containing confidential settings to be exposed in the JavaScript bundle delivered to all website visitors. This information disclosure allows attackers to view sensitive configuration details without authentication. The vulnerability affects UptimeFlare instances prior to commit 377a596 and has been patched.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Uptimeflare. UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This