Executive brief
OneUptime is an open-source platform used by organizations to monitor system uptime and manage incident responses. A security flaw in the platform's Worker service allows unauthorized individuals to trigger automated workflows without logging in. If an attacker identifies a specific workflow ID, they can execute tasks that could lead to unauthorized data changes, fraudulent notifications, or the execution of malicious code within the system environment.
Technical details
The ManualAPI component in the OneUptime Worker service fails to implement authentication middleware for its workflow execution endpoints (GET/POST `/workflow/manual/run/:workflowId`). This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), allows a remote, unauthenticated attacker to trigger any workflow if they can obtain or guess the `workflowId`. Because the handler accepts `req.body.data` as workflow `returnValues`, attackers can provide arbitrary input to the execution environment. This can lead to JavaScript code execution via the VMRunner component, notification abuse (SMS/Email spam), and unauthorized data manipulation within the platform. The issue is resolved in version 10.0.42.
Affected products
- OneUptime OneUptime < 10.0.42
Timeline
- 2026-03-31: patched: Version 10.0.42 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD