PT-2026-21375 · Oneuptime · Oneuptime

Byamb4 · Published 2026-02-21 · Updated 2026-03-09 · CVE-2026-27574

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OneUptime versions 9.5.13 and below

Description OneUptime is a solution for monitoring and managing online services. The custom JavaScript monitor feature utilizes Node.js's node:vm module, which is explicitly documented as not being a security mechanism, to execute user-supplied code. This allows for a trivial sandbox escape via a one-liner, granting full access to the underlying process. The probe operates with host networking and contains sensitive cluster credentials, including ONEUPTIME SECRET, DATABASE PASSWORD, REDIS PASSWORD, and CLICKHOUSE PASSWORD, within its environment variables. Monitor creation is accessible to the lowest role (ProjectMember) with open registration enabled by default, enabling any anonymous user to potentially achieve full cluster compromise in approximately 30 seconds.

Recommendations Update to version 10.0.5 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-27574

GHSA-V264-XQH4-9XMM

Affected Products

Oneuptime

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27574.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-v264-xqh4-9xmm · Vendor Advisory
• https://github.com/OneUptime/oneuptime/commit/7f9ed4d43945574702a26b7c206e38cc344fe427 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27574 · Security Note
• https://osv.dev/vulnerability/GHSA-v264-xqh4-9xmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27574 · Vendor Advisory
• https://github.com/OneUptime/oneuptime · Note
• https://twitter.com/CCBalert/status/2028489884193701931 · Twitter Post
• https://twitter.com/TheHackerWire/status/2025168157787463821 · Twitter Post
• https://twitter.com/pulsepatchio/status/2025579180776182212 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025203657747161468 · Twitter Post
• https://t.me/cveNotify/152721 · Telegram Post
• https://twitter.com/ytroncal/status/2030954624727892057 · Twitter Post
• https://twitter.com/_cvereports/status/2026328934749556837 · Twitter Post
• https://twitter.com/CveTodo/status/2025170758255714663 · Twitter Post