Is CVE-2026-35053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35053 being exploited in the wild.

How severe is CVE-2026-35053?

Critical severity, with a CVSS score of 9.8, published 2 April 2026.

Is there a fix for CVE-2026-35053?

A patch was published on 2026-03-31: Version 10.0.42 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35053 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-35053?

Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35053: OneUptime missing authentication in Worker ManualAPI workflow execution

CVE-2026-35053 · Severity: critical · CVSS 9.8 · Published 2026-04-02

OneUptime is an open-source platform used by organizations to monitor system uptime and manage incident responses. A security flaw in the platform's Worker service allows unauthorized individuals to trigger automated workflows without logging in. If an attacker identifies a specific workflow ID, they can execute tasks that could lead to unauthorized data changes, fraudulent notifications, or the execution of malicious code within the system environment.

Technologies: OneUptime. Vendors: OneUptime.

Quick answers

Is CVE-2026-35053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35053 being exploited in the wild.
How severe is CVE-2026-35053?: Critical severity, with a CVSS score of 9.8, published 2 April 2026.
Which products and versions are affected?: OneUptime < 10.0.42.
Is there a fix for CVE-2026-35053?: A patch was published on 2026-03-31: Version 10.0.42 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35053 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-35053?: Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ManualAPI component in the OneUptime Worker service fails to implement authentication middleware for its workflow execution endpoints (GET/POST `/workflow/manual/run/:workflowId`). This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), allows a remote, unauthenticated attacker to trigger any workflow if they can obtain or guess the `workflowId`. Because the handler accepts `req.body.data` as workflow `returnValues`, attackers can provide arbitrary input to the execution environment. This can lead to JavaScript code execution via the VMRunner component, notification abuse (SMS/Email spam), and unauthorized data manipulation within the platform. The issue is resolved in version 10.0.42.

Affected products

OneUptime OneUptime < 10.0.42

Timeline

2026-03-31: patched: Version 10.0.42 released
2026-04-01: advisory: GitHub Security Advisory published
2026-04-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.