PT-2026-29875 · Oneuptime · Oneuptime

Axel-Corsiez · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34758

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.42

Description OneUptime, an open-source monitoring and observability platform, had an issue where unauthenticated access to Notification test and Phone Number management endpoints allowed for abuse, including SMS, call, email, and WhatsApp spamming, as well as unauthorized phone number purchases. Attackers could potentially drain budgets and flood targets with unwanted messages.

Recommendations Update to version 10.0.42 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-34758

Affected Products

Oneuptime

References · 8

• 🔥 https://github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hp · Exploit
• https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34758 · Security Note
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.42 · Note
• https://twitter.com/TheHackerWire/status/2039915887122428222 · Twitter Post
• https://twitter.com/CveFindCom/status/2039828472000880813 · Twitter Post
• https://twitter.com/CVEnew/status/2040128781570945405 · Twitter Post
• https://twitter.com/0dayPublishing/status/2040103145896858013 · Twitter Post