EUVD-2026-11719
GHSA-p5g2-jm85-8g35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OneUptime
-
DeliverySubmit malicious aggregationType parameter
-
ExploitInject SQL into ClickHouse query
-
ExecutionExecute arbitrary SQL commands
-
ImpactRead/modify cross-tenant telemetry data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account required; telemetry aggregation API must be accessible; ClickHouse backend must be configured as data store; no input validation on aggregationType, aggregateColumnName, or aggregationTimestampColumnName parameters in OneUptime versions prior to 10.0.23. |
| Impact | CVSS 9.9. |
| Exploit ScenarioDerived | SQL injection via aggregation params. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
SQL injection in OneUptime telemetry API before 10.0.23.
Earlier versions of this analysis (1)
SQLi in OneUptime telemetry.
RemediationAI
Update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89.
Know when Oneuptime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.
Executive ViewAI
OneUptime monitoring deployments are vulnerable to SQL injection attacks that could allow authenticated users to access all tenant data, modify databases, and potentially execute code. Organizations using OneUptime versions before 10.0.23 face immediate risk of data breach and system compromise, particularly if the telemetry aggregation API is exposed to untrusted users.
Restrict network access to telemetry aggregation API through firewall rules or network segmentation; implement Web Application Firewall (WAF) rules to block SQL injection patterns and suspicious ClickHouse syntax; disable the telemetry aggregation API feature if operationally feasible; enforce strict API authentication and rate limiting; implement real-time monitoring and alerting for anomalous database queries; segment ClickHouse database access with least-privilege credentials; conduct regular database activity audits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in OneUptime Information Disclosure and XSS
View all 3OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands
OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring conf
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validatio
OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit
Exploit-DB