Is CVE-2026-33142 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33142 being exploited in the wild.

How severe is CVE-2026-33142?

High severity, with a CVSS score of 8.1, published 20 March 2026.

Which products and versions are affected?

OneUptime all versions up to and including 10.0.23.

Is there a fix for CVE-2026-33142?

A patch was published on 2026-03-18: Fix released in version 10.0.34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33142 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33142?

Check whether you run Hackerbay Oneuptime or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33142: OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for (ClickHouse SQL in

CVE-2026-33142 · Severity: high · CVSS 8.1 · Published 2026-03-20

OneUptime is an open-source observability platform that collects and analyzes logs, metrics, and trace data in a ClickHouse database. A SQL injection vulnerability allows authenticated users to inject malicious SQL commands through sort, select, and groupBy request parameters, enabling unauthorized access to, modification of, or deletion of stored analytics data.

Technologies: Hackerbay Oneuptime, OneUptime. Vendors: Hackerbay, OneUptime.

Quick answers

Is CVE-2026-33142 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33142 being exploited in the wild.
How severe is CVE-2026-33142?: High severity, with a CVSS score of 8.1, published 20 March 2026.
Which products and versions are affected?: OneUptime all versions up to and including 10.0.23.
Is there a fix for CVE-2026-33142?: A patch was published on 2026-03-18: Fix released in version 10.0.34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33142 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33142?: Check whether you run Hackerbay Oneuptime or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OneUptime's StatementGenerator class constructs ClickHouse SQL queries by iterating over user-provided object keys from API request bodies without validating that they correspond to actual database columns. The toSortStatement, toSelectStatement, and toGroupByStatement methods pass unsanitized column names as ClickHouse Identifier parameters, which are substituted directly into queries without escaping. An authenticated attacker can inject arbitrary ClickHouse SQL through crafted sort, select, or groupBy parameters in requests to analytics list or aggregate endpoints (BaseAnalyticsAPI.getList or BaseAnalyticsAPI.getAggregate), allowing reading, modifying, or deleting analytics data. The vulnerability was introduced because an incomplete fix for a previous SQL injection vulnerability (GHSA-p5g2-jm85-8g35) applied validation only to the _aggregateBy method but not to the three other vulnerable query construction methods. PostgreSQL data is not affected. Fix: Applied in version 10.0.34.

Affected products

OneUptime OneUptime all versions up to and including 10.0.23

Identifiers

CVE-2026-33142
GHSA-gcg3-c5p2-cqgg

Timeline

2026-03-18: disclosed: GHSA-gcg3-c5p2-cqgg published
2026-03-18: patched: Fix released in version 10.0.34

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gcg3-c5p2-cqgg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.