Critical severity9.8NVD Advisory· Published Apr 2, 2026· Updated Apr 13, 2026
CVE-2026-35053
CVE-2026-35053
Description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7nvdExploitVendor Advisory
- github.com/OneUptime/oneuptime/releases/tag/10.0.42nvdProductRelease Notes
News mentions
0No linked articles in our index yet.