What is the CVSS score of CVE-2026-32306?

CVE-2026-32306 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oneuptime are affected by CVE-2026-32306?

OneUptime monitoring deployments are vulnerable to SQL injection attacks that could allow authenticated users to access all tenant data, modify databases, and potentially execute code.. A patch is available.

How to fix or mitigate CVE-2026-32306?

Within 24 hours: Identify all OneUptime deployments and their versions; disable or restrict access to the telemetry aggregation API if possible; review recent API access logs for suspicious activity. Within 7 days: Implement network segmentation to limit API access to trusted internal networks only; apply input validation and WAF rules to block SQL injection patterns; conduct threat hunting for evidence of exploitation. Within 30 days: Upgrade to OneUptime version 10.0.23 or later once available; implement enhanced API authentication and audit logging; conduct security assessment of affected systems.

Oneuptime CVE-2026-32306

EUVD-2026-11719 CRITICAL

SQL Injection (CWE-89)

2026-03-13 security-advisories@github.com

GHSA-p5g2-jm85-8g35

RCE SQLi Oneuptime

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-11719

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:54 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.