OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

Vulnerability

Overview

CVE-2026-33142 is a ClickHouse SQL injection vulnerability in OneUptime, an open-source monitoring and observability platform. The root cause is that the toSortStatement, toSelectStatement, and toGroupByStatement methods in StatementGenerator.ts accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns [1][3]. ClickHouse Identifier parameters are substituted directly into queries without escaping, making this a direct injection vector [3].

Attack

Vector and Prerequisites

An attacker who is authenticated and can reach any analytics list or aggregate endpoint (such as those for logs, metrics, spans, or exceptions) can exploit this vulnerability [3]. The BaseAnalyticsAPI.ts deserializes sort, select, and groupBy directly from req.body and passes them to the service layer without column validation [3]. This allows an attacker to craft malicious object keys that, when used as ClickHouse identifiers, inject arbitrary SQL.

Impact

A successful exploit allows an authenticated attacker to execute arbitrary ClickHouse SQL queries. This could lead to unauthorized data access, data exfiltration, or other database-level compromise [1][3]. The vulnerability is distinct from the previously fixed CVE-2026-32306, which only addressed validation in the _aggregateBy method [1].

Mitigation

The issue has been patched in OneUptime version 10.0.34 [1]. Users should upgrade to this version or later to remediate the vulnerability. No workarounds are mentioned in the available references.