What is the CVSS score of CVE-2026-30956?

CVE-2026-30956 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-30956?

A critical vulnerability in OneUptime allows unauthorized users to bypass security controls and access data across different customer environments, potentially exposing sensitive monitoring and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-30956?

Yes, a public proof-of-concept exploit is available for CVE-2026-30956. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30956?

Within 24 hours: Inventory all OneUptime instances and their versions, isolate affected systems from production networks if possible, and contact OneUptime vendor for emergency patch timeline. Within 7 days: Implement network-level access controls to restrict OneUptime API endpoints, deploy WAF rules to block forged is-multi-tenant-query headers, and enforce strict input validation on projectid parameters. Within 30 days: Upgrade to OneUptime v10.0.21 or later when available, conduct security audit of OneUptime access logs for exploitation signs, and implement additional multi-factor authentication for OneUptime administrative access.

Node.js CVE-2026-30956

CRITICAL

Improper Authorization (CWE-285)

2026-03-10 security-advisories@github.com

GHSA-r5v6-2599-9g3m

Authentication Bypass Privilege Escalation Information Disclosure Node.js Oneuptime

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 12, 2026 - 14:11 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 18:18 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.21.

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.

AnalysisAI

OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Low-privileged user crafts HTTP request

Exploit

Include forged is-multi-tenant-query header with controlled projectid

Execution

Bypass BasePermission authorization checks

Impact

Access cross-tenant project data and sensitive fields

Access

Low-privileged user crafts HTTP request

Exploit

Include forged is-multi-tenant-query header with controlled projectid

Execution

Bypass BasePermission authorization checks

Impact

Access cross-tenant project data and sensitive fields

Vulnerability AssessmentAI

Exploitation	OneUptime v10.0.20 and earlier with multi-tenant architecture enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.9 with PoC. Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged user accesses admin monitoring functions.
Remediation	Update OneUptime. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all OneUptime instances and their versions, isolate affected systems from production networks if possible, and contact OneUptime vendor for emergency patch timeline. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2025-71329 HIGH Monitor POC

8.7 Jun 10

Denial of service in the image-size Node.js library through version 2.0.2 allows remote unauthenticated attackers to per

CVE-2025-71330 HIGH This Week POC

8.7 Jun 10

Denial of service in the image-size Node.js library (versions up to and including 2.0.2) allows remote unauthenticated a

CVE-2026-53633 CRITICAL Act Now

9.8 Jun 15

Remote code execution in Vitest Browser Mode (npm @vitest/browser 3.0.0-3.2.4, 4.0.0-4.1.7, 5.0.0-beta.0-5.0.0-beta.3) a

CVE-2026-48714 CRITICAL Act Now

9.1 Jun 15

Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.p

CVE-2026-53609 CRITICAL Act Now

9.1 Jun 12

Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object

CVE-2026-30956 vulnerability details – vuln.today

Back

Node.js CVE-2026-30956

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code