CVE-2026-33396Disclosure(hackerbay / oneuptime)

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch hackerbay oneuptime systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.

hackerbay CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/OneUptime/oneuptime/commit/e8e4ee3ff0740eb131045ab3d67453141c46178a

Exploit / PoC references

Weakness type (CWE)

CWE-78CWE-184CWE-693

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

oneuptime

Threat summary

Patch or workaround signal is available
9 mentions across 4 observed days
Momentum state: declining

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 3d ago at 6 mentions (2026-03-26); latest day: 1
9 total mentions across 4 days

Affected systems

Vendors

hackerbay

Products

oneuptime

Deep dive

Activity timeline9 mentions / 4d

Signal classification3 categories

Disclosure

555.6%

Patch

333.3%

General

111.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-26	6	Disclosure3Patch3
2026-03-27	1	General1
2026-03-28	1	Disclosure1
2026-03-29	1	Disclosure1

Full discourse9 posts

maruomosquit@maru1151157194d
Disclosure
🚨 CVE-2026-33396 (CVSS: 9.9) 2026-33396: OneUptime v10.0.35以前、ProjectMemberはSynthetic Monitor Playwrightスクリプトを悪用し、Probeコンテナ/ホストにリモートコマンド実行可能。サンドボックスのdenylistが不完全で、_browserType.launchServerを介して任意プロセスを生成可能。バージョン10.0.35で修正。 https://maruomosquit.com/vulnerability/CVE-2026-33396/ #脆弱性 #セキュリティ
Post summary
The post discloses a high‑severity remote code execution vulnerability in OneUptime versions before 10.0.35, details how Playwright scripts can be abused, notes the issue is fixed in v10.0.35, and links to a vulnerability page for more information.
0001065
1.4K followersView on X
White Rabbitx@TheRabbitPy196d
Patch
🚨 CVE-2026-33396 (CVSS 9.9 Critical): Synthetic Monitoring Playwright sandbox RCE via OS command injection. Incomplete denylist allows full compromise. Patch immediately! https://nvd.nist.gov/vuln/detail/CVE-2026-33396
Post summary
CVE‑2026‑33396 is a critical OS command injection vulnerability (CVSS 9.9) in Synthetic Monitoring Playwright sandbox, allowing full compromise; immediate patching is required.
1000053
492 followersView on X
CVE@CVEnew193d
Disclosure
CVE-2026-33396 OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote co… https://www.cve.org/CVERecord?id=CVE-2026-33396
Post summary
The tweet announces CVE‑2026‑33396, noting that a low‑privileged authenticated user in OneUptime prior to v10.0.35 can achieve remote exploitation, but no PoC, exploit code, or patch is mentioned.
0000098
56.9K followersView on X
CTIWatch@ctiwatchcloud195d
General
🔍 Today's Top Vulnerabilities 🔴 CVE-2026-33494 | CVSS 10.0 🔴 CVE-2026-33897 | CVSS 9.9 🔴 CVE-2026-33396 | CVSS 9.9 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The post announces three high‑CVSS CVEs and links to a vulnerabilities page, but it provides no PoC, exploit, mitigation, or detailed technical information.
0000034
5.6K followersView on X
The Hacker Wire@TheHackerWire196d
Disclosure
🔴 CVE-2026-33396 - Critical OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on th... https://www.thehackerwire.com/vulnerability/CVE-2026-33396/ https://t.co/JBb8drQd8Q
Post summary
The text announces CVE‑2026‑33396, a critical remote command execution flaw for low‑privileged users in OneUptime versions below 10.0.35, without providing PoC, exploit code, or patch details.
0000045
163 followersView on X
White Rabbitx@TheRabbitPy196d
Patch
🚨 Today's top CVE: CVE-2026-33396 (CVSS 9.9 Critical) - OS Command Injection in Synthetic Monitor's Playwright sandbox. Allows full RCE via incomplete denylist. Patch ASAP if using it! Published Mar 26, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-33396
Post summary
The post announces a critical OS command injection vulnerability (CVE-2026-33396) with an immediate patch recommendation.
0000033
492 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash196d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33396 - OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe Intel Report: https://ift.tt/BIUnHFZ
Post summary
The tweet announces CVE-2026-33396, revealing a sandbox escape flaw in OneUptime's Synthetic Monitor Playwright runtime that permits arbitrary command execution on the Probe, with no mention of patches, exploits, or active exploitation.
0000031
285 followersView on X
CVEFind.com@CveFindCom196d
Patch
[CVE-2026-33396: CRITICAL] Vulnerability alert: OneUptime platform < 10.0.35 allows remote command execution by low-privileged users. Update to version 10.0.35 to patch this security flaw.#cve,CVE-2026-33396,#cybersecurity https://cvefind.com/CVE-2026-33396
Post summary
The post alerts to a critical remote command execution vulnerability in OneUptime versions below 10.0.35 and directs users to update to 10.0.35 to mitigate the risk.
0000063
606 followersView on X
0day Signal@0dayPublishing196d
Disclosure
🚨 CVE-2026-33396: OneUptime has sandbox escape in ... Denylist sandboxes are jokes—Playwright's `_browserType.launchServer()` bypass turns monitoring scripts into RCE goldmi... https://zerodaysignal.com/vulnerability/CVE-2026-33396 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-33396, noting a sandbox escape vulnerability in Playwright that can lead to remote code execution via monitoring scripts.
0000086
169 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hackerbay	oneuptime	-	-	-

Explore more

Back to dashboard hackerbay CVEs oneuptime vulnerabilities

What researchers are saying

CVE-2026-33396

maruomosquit[verified]@maru1151157Disclosure

The post discloses a high‑severity remote code execution vulnerability in OneUptime versions before 10.0.35, details how Playwright scripts can be abused, notes the issue is fixed in v10.0.35, and links to a vulnerability page for more information.

White Rabbitx[verified]@TheRabbitPyPatch

CVE‑2026‑33396 is a critical OS command injection vulnerability (CVSS 9.9) in Synthetic Monitoring Playwright sandbox, allowing full compromise; immediate patching is required.

White Rabbitx[verified]@TheRabbitPyPatch

The post announces a critical OS command injection vulnerability (CVE-2026-33396) with an immediate patch recommendation.

CVE@CVEnewDisclosure

The tweet announces CVE‑2026‑33396, noting that a low‑privileged authenticated user in OneUptime prior to v10.0.35 can achieve remote exploitation, but no PoC, exploit code, or patch is mentioned.

CTIWatch@ctiwatchcloudGeneral

The post announces three high‑CVSS CVEs and links to a vulnerabilities page, but it provides no PoC, exploit, mitigation, or detailed technical information.

The Hacker Wire@TheHackerWireDisclosure

The text announces CVE‑2026‑33396, a critical remote command execution flaw for low‑privileged users in OneUptime versions below 10.0.35, without providing PoC, exploit code, or patch details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The tweet announces CVE-2026-33396, revealing a sandbox escape flaw in OneUptime's Synthetic Monitor Playwright runtime that permits arbitrary command execution on the Probe, with no mention of patches, exploits, or active exploitation.

CVEFind.com@CveFindComPatch

The post alerts to a critical remote command execution vulnerability in OneUptime versions below 10.0.35 and directs users to update to 10.0.35 to mitigate the risk.