What is the CVSS score of CVE-2026-30956?

CVE-2026-30956 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-30956?

A critical vulnerability in OneUptime allows unauthorized users to bypass security controls and access data across different customer environments, potentially exposing sensitive monitoring and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-30956?

Yes, a public proof-of-concept exploit is available for CVE-2026-30956. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30956?

Within 24 hours: Inventory all OneUptime instances and their versions, isolate affected systems from production networks if possible, and contact OneUptime vendor for emergency patch timeline. Within 7 days: Implement network-level access controls to restrict OneUptime API endpoints, deploy WAF rules to block forged is-multi-tenant-query headers, and enforce strict input validation on projectid parameters. Within 30 days: Upgrade to OneUptime v10.0.21 or later when available, conduct security audit of OneUptime access logs for exploitation signs, and implement additional multi-factor authentication for OneUptime administrative access.

Node.js CVE-2026-30956

CRITICAL

Improper Authorization (CWE-285)

2026-03-10 security-advisories@github.com

GHSA-r5v6-2599-9g3m

Authentication Bypass Privilege Escalation Information Disclosure Node.js Oneuptime Hackerbay

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 12, 2026 - 14:11 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 18:18 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.21.

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.