CVE-2026-35053: OneUptime: Unauthenticated Workflow Execution via ManualAPI
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OneUptimeto a version that resolves this vulnerability.Fixed in 10.0.42
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35053?
The severity of CVE-2026-35053 is classified as high due to the potential for unauthenticated access to sensitive functionality.
How do I fix CVE-2026-35053?
To fix CVE-2026-35053, upgrade to OneUptime version 10.0.42 or later.
What kind of vulnerability is CVE-2026-35053?
CVE-2026-35053 is an unauthenticated workflow execution vulnerability in OneUptime's ManualAPI.
Which versions of OneUptime are affected by CVE-2026-35053?
OneUptime versions prior to 10.0.42 are affected by CVE-2026-35053.
What are the potential impacts of CVE-2026-35053?
The potential impacts of CVE-2026-35053 include unauthorized execution of workflows, which could lead to misuse of the monitoring and observability platform.