PT-2026-23863 · Unknown+1 · Uptimeflare+1

C8503 · Publicado 2026-03-07 · Atualizado 2026-03-12 · CVE-2026-29779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UptimeFlare versions prior to commit 377a596

Description UptimeFlare, a serverless uptime monitoring and status page solution powered by Cloudflare Workers, had a configuration issue. The uptime.config.ts file exported both pageConfig (intended for client use) and workerConfig (containing sensitive server-only data) from the same module. The client-side component pages/incidents.tsx directly imported and used the workerConfig object, resulting in the inclusion of sensitive data within the client-side JavaScript bundle served to all visitors. This issue was addressed with commit 377a596. The workerConfig contains sensitive data.

Recommendations Update to commit 377a596 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-29779

GHSA-36Q9-V7P3-VJ6V

Produtos afetados

Cloudflare Workers

Uptimeflare

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29779.json · Exploit
• https://github.com/lyc8503/UptimeFlare/security/advisories/GHSA-36q9-v7p3-vj6v · Aviso do Fabricante
• https://github.com/lyc8503/UptimeFlare/issues/198 · Nota
• https://github.com/lyc8503/UptimeFlare/commit/377a5963c66ba9a798abebfe8d80378b053435e9 · Correção
• https://twitter.com/CVEnew/status/2030339303755354433 · Publicação no Twitter
• https://twitter.com/dailycve/status/2031946421830594983 · Publicação no Twitter
• https://t.me/cveNotify/154605 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-29779 · Nota de Segurança
• https://t.me/CVEtracker/46726 · Publicação no Telegram
• https://twitter.com/VivekIntel/status/2030918182119366843 · Publicação no Twitter
• https://t.me/cveNotify/155190 · Publicação no Telegram
• https://twitter.com/cracbot/status/2032049039009857959 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-29779 · Aviso do Fabricante