CVE-2026-32306Disclosure(hackerbay / oneuptime)

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch hackerbay oneuptime systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.

hackerbay CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

oneuptime

Threat summary

Patch or workaround signal is available
9 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 4 classified signals
Peaked 5d ago at 2 mentions (2026-03-12); latest day: 2
9 total mentions across 6 days

Affected systems

Vendors

hackerbay

Products

oneuptime

Deep dive

Activity timeline9 mentions / 6d

Signal classification3 categories

Disclosure

444.4%

General

444.4%

Patch

111.1%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-12	2	Disclosure2
2026-03-13	2	General1Patch1
2026-03-16	1	Disclosure1
2026-03-18	1	Disclosure1
2026-03-20	1	General1
2026-03-21	2	General2

Full discourse9 posts

maruomosquit@maru1151157206d
Disclosure
🚨 CVE-2026-32306 (CVSS: 9.9) 10.0.23以前のOneUptimeのtelemetry APIで、ユーザー制御パラメータを直接SQLクエリに挿入（.appendメソッド）。入力検証・パラメータバインディングなし。認証ユーザーがSQLインジェクション可能。データ漏洩・改ざん・リモートコード実行リスクあり。 https://maruomosquit.com/vulnerability/CVE-2026-32306/ #脆弱性 #セキュリティ
Post summary
OneUptime telemetry API (v10.0.23 and older) is vulnerable to SQL injection through unsanitized user parameters, enabling authenticated users to potentially execute remote code; the issue is newly disclosed with a CVSS score of 9.9.
0002096
2.0K followersView on X
Infoflowcloud@infoflowcloud201d
General
🚨*CVE* CVE-2026-33142 OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate quer… https://www.cve.org/CVERecord?id=CVE-2026-33142 ----- Traducción: CVE-2026-33142 One… http://infoflow.cloud`
Post summary
The post merely mentions a CVE identifier and links to its public record, offering no additional technical details, PoC, exploitation claims, patches, or debunking.
0000041
61 followersView on X
CVE@CVEnew201d
General
CVE-2026-33142 OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate quer… https://www.cve.org/CVERecord?id=CVE-2026-33142
Post summary
The text merely references CVE‑2026‑33142 and provides a link to its CVE record, offering no details on patches, exploitation, PoC, or technical aspects.
00000189
56.8K followersView on X
The Hacker Wire@TheHackerWire201d
General
🟠 CVE-2026-33142 - High OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added colum... https://www.thehackerwire.com/vulnerability/CVE-2026-33142/ https://t.co/uue75vg6yl
Post summary
The tweet announces CVE‑2026‑33142 as a high‑severity issue but provides no technical details, exploit code, or patch information.
0000056
138 followersView on X
PulsePatch.io@pulsepatchio204d
Disclosure
Affected: `OneUptime ClickHouse`. Impact: SQL injection allows arbitrary SQL execution. CVE-2026-32306. Assess exposure and apply robust input validation. #SQLi #ClickHouse #infosec https://www.pulsepatch.io/posts/cve-2026-32306-oneuptime-clickhouse-sql-injection
Post summary
CVE-2026-32306 exposes an SQL injection flaw in OneUptime ClickHouse that permits arbitrary SQL execution. No PoC or active exploitation is reported; robust input validation is advised as a mitigation.
0000043
1 followersView on X
The Hacker Wire@TheHackerWire208d
General
🔴 CVE-2026-32306 - Critical OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggr... https://www.thehackerwire.com/vulnerability/CVE-2026-32306/ https://t.co/u47I7DEyWF
Post summary
The tweet announces CVE-2026-32306 as critical but provides no further detail, PoC, patch, or exploitation evidence.
0000031
134 followersView on X
CVEFind.com@CveFindCom208d
Patch
[CVE-2026-32306: CRITICAL] OneUptime solution had a cyber security flaw allowing SQL injection before version 10.0.23, enabling unauthorized data access and potential code execution. Update to latest version...#cve,CVE-2026-32306,#cybersecurity https://cvefind.com/CVE-2026-32306
Post summary
The post highlights CVE-2026-32306 as a critical SQL injection flaw in OneUptime, notes it is fixed in versions 10.0.23 and later, and urges users to upgrade. No exploit code, PoC, or active exploitation details are provided.
0000040
602 followersView on X
CVE@CVEnew209d
Disclosure
CVE-2026-32306 OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregat… https://www.cve.org/CVERecord?id=CVE-2026-32306
Post summary
The message announces CVE-2026-32306 in OneUptime's telemetry aggregation API, offering initial technical details without indicating exploitation or mitigation.
0000079
56.7K followersView on X
0day Signal@0dayPublishing209d
Disclosure
🚨 CVE-2026-32306: OneUptime ClickHouse SQL Injecti... Direct SQL interpolation into ClickHouse with zero validation = instant multi-tenant data breach and RCE via table func... https://zerodaysignal.com/vulnerability/CVE-2026-32306 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-32306, a ClickHouse SQL injection that permits a multi‑tenant data breach and remote code execution via unvalidated table functions.
0000071
144 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hackerbay	oneuptime	-	-	-

Explore more

Back to dashboard hackerbay CVEs oneuptime vulnerabilities

What researchers are saying

CVE-2026-32306

maruomosquit[verified]@maru1151157Disclosure

OneUptime telemetry API (v10.0.23 and older) is vulnerable to SQL injection through unsanitized user parameters, enabling authenticated users to potentially execute remote code; the issue is newly disclosed with a CVSS score of 9.9.

Infoflowcloud@infoflowcloudGeneral

The post merely mentions a CVE identifier and links to its public record, offering no additional technical details, PoC, exploitation claims, patches, or debunking.

CVE@CVEnewGeneral

The text merely references CVE‑2026‑33142 and provides a link to its CVE record, offering no details on patches, exploitation, PoC, or technical aspects.

The Hacker Wire@TheHackerWireGeneral

The tweet announces CVE‑2026‑33142 as a high‑severity issue but provides no technical details, exploit code, or patch information.

PulsePatch.io@pulsepatchioDisclosure

CVE-2026-32306 exposes an SQL injection flaw in OneUptime ClickHouse that permits arbitrary SQL execution. No PoC or active exploitation is reported; robust input validation is advised as a mitigation.

The Hacker Wire@TheHackerWireGeneral

The tweet announces CVE-2026-32306 as critical but provides no further detail, PoC, patch, or exploitation evidence.

CVEFind.com@CveFindComPatch

The post highlights CVE-2026-32306 as a critical SQL injection flaw in OneUptime, notes it is fixed in versions 10.0.23 and later, and urges users to upgrade. No exploit code, PoC, or active exploitation details are provided.

CVE@CVEnewDisclosure

The message announces CVE-2026-32306 in OneUptime's telemetry aggregation API, offering initial technical details without indicating exploitation or mitigation.