# CVE-2026-35053: OneUptime missing authentication in Worker ManualAPI workflow execution

Source: https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35053 · Severity: critical · CVSS 9.8 · Published 2026-04-02

OneUptime is an open-source platform used by organizations to monitor system uptime and manage incident responses. A security flaw in the platform's Worker service allows unauthorized individuals to trigger automated workflows without logging in. If an attacker identifies a specific workflow ID, they can execute tasks that could lead to unauthorized data changes, fraudulent notifications, or the execution of malicious code within the system environment.

Technologies: [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-35053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35053 being exploited in the wild.

**How severe is CVE-2026-35053?** Critical severity, with a CVSS score of 9.8, published 2 April 2026.

**Which products and versions are affected?** OneUptime < 10.0.42.

**Is there a fix for CVE-2026-35053?** A patch was published on 2026-03-31: Version 10.0.42 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35053 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-35053?** Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ManualAPI component in the OneUptime Worker service fails to implement authentication middleware for its workflow execution endpoints (GET/POST `/workflow/manual/run/:workflowId`). This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), allows a remote, unauthenticated attacker to trigger any workflow if they can obtain or guess the `workflowId`. Because the handler accepts `req.body.data` as workflow `returnValues`, attackers can provide arbitrary input to the execution environment. This can lead to JavaScript code execution via the VMRunner component, notification abuse (SMS/Email spam), and unauthorized data manipulation within the platform. The issue is resolved in version 10.0.42.

## Affected products

- OneUptime OneUptime < 10.0.42

## Timeline

- 2026-03-31: patched: Version 10.0.42 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD

## References

- [https://github.com/OneUptime/oneuptime/releases/tag/10.0.42](https://github.com/OneUptime/oneuptime/releases/tag/10.0.42)
- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)
- [OneUptime missing authorization in notification API endpoints](https://junglewise.ai/threats/cve-2026-34759-oneuptime-missing-authorization-in-notification-api-endpoints)