PT-2026-21375 · Oneuptime · Oneuptime

Byamb4 · Publicado 2026-02-21 · Atualizado 2026-03-09 · CVE-2026-27574

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OneUptime versions 9.5.13 and below

Description OneUptime is a solution for monitoring and managing online services. The custom JavaScript monitor feature utilizes Node.js's node:vm module, which is explicitly documented as not being a security mechanism, to execute user-supplied code. This allows for a trivial sandbox escape via a one-liner, granting full access to the underlying process. The probe operates with host networking and contains sensitive cluster credentials, including ONEUPTIME SECRET, DATABASE PASSWORD, REDIS PASSWORD, and CLICKHOUSE PASSWORD, within its environment variables. Monitor creation is accessible to the lowest role (ProjectMember) with open registration enabled by default, enabling any anonymous user to potentially achieve full cluster compromise in approximately 30 seconds.

Recommendations Update to version 10.0.5 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-27574

GHSA-V264-XQH4-9XMM

Produtos afetados

Oneuptime

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27574.json · Exploit
• https://github.com/OneUptime/oneuptime · Nota
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-v264-xqh4-9xmm · Aviso do Fabricante
• https://github.com/OneUptime/oneuptime/commit/7f9ed4d43945574702a26b7c206e38cc344fe427 · Correção
• https://twitter.com/CCBalert/status/2028489884193701931 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2025168157787463821 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2025579180776182212 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2025203657747161468 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27574 · Nota de Segurança
• https://t.me/cveNotify/152721 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-v264-xqh4-9xmm · Aviso do Fabricante
• https://twitter.com/ytroncal/status/2030954624727892057 · Publicação no Twitter
• https://twitter.com/_cvereports/status/2026328934749556837 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2025170758255714663 · Publicação no Twitter
• https://twitter.com/ByamB4/status/2025158619101298850 · Publicação no Twitter