CVE-2026-34759: OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OneUptimeto a version that resolves this vulnerability.Fixed in 10.0.42 - Compensating control
Restrict external access to the OneUptime Nginx proxy notification endpoints at /notification/ so only trusted/authorized clients can reach them.
- Operational
Review the Twilio account for unauthorized actions: purchase attempts of phone numbers and deletion of existing alerting numbers; restore any missing alerting numbers to ensure alerting service continuity.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34759?
CVE-2026-34759 has a high severity due to the potential for financial abuse and exposure of SMTP credentials.
How do I fix CVE-2026-34759?
To fix CVE-2026-34759, upgrade OneUptime to version 10.0.42 or later.
What are the vulnerabilities associated with CVE-2026-34759?
CVE-2026-34759 involves unauthenticated access to multiple notification API endpoints, risking financial abuse and service disruption.
What versions of OneUptime are affected by CVE-2026-34759?
OneUptime versions before 10.0.42 are affected by CVE-2026-34759.
Is there a risk of data exposure from CVE-2026-34759?
Yes, CVE-2026-34759 presents a risk of SMTP credential exposure, leading to potential data breaches.