PT-2026-23863 · Unknown+1 · Uptimeflare+1

C8503 · Published 2026-03-07 · Updated 2026-03-12 · CVE-2026-29779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UptimeFlare versions prior to commit 377a596

Description UptimeFlare, a serverless uptime monitoring and status page solution powered by Cloudflare Workers, had a configuration issue. The uptime.config.ts file exported both pageConfig (intended for client use) and workerConfig (containing sensitive server-only data) from the same module. The client-side component pages/incidents.tsx directly imported and used the workerConfig object, resulting in the inclusion of sensitive data within the client-side JavaScript bundle served to all visitors. This issue was addressed with commit 377a596. The workerConfig contains sensitive data.

Recommendations Update to commit 377a596 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-29779

GHSA-36Q9-V7P3-VJ6V

Affected Products

Cloudflare Workers

Uptimeflare

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29779.json · Exploit
• https://github.com/lyc8503/UptimeFlare/security/advisories/GHSA-36q9-v7p3-vj6v · Vendor Advisory
• https://github.com/lyc8503/UptimeFlare/commit/377a5963c66ba9a798abebfe8d80378b053435e9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-29779 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29779 · Vendor Advisory
• https://github.com/lyc8503/UptimeFlare/issues/198 · Note
• https://twitter.com/CVEnew/status/2030339303755354433 · Twitter Post
• https://twitter.com/dailycve/status/2031946421830594983 · Twitter Post
• https://t.me/cveNotify/154605 · Telegram Post
• https://t.me/CVEtracker/46726 · Telegram Post
• https://twitter.com/VivekIntel/status/2030918182119366843 · Twitter Post
• https://t.me/cveNotify/155190 · Telegram Post
• https://twitter.com/cracbot/status/2032049039009857959 · Twitter Post