CVE-2026-34758
OneUptime, an open‑source monitoring platform, had a critical flaw that let anyone send SMS, calls, emails, or WhatsApp messages and even buy phone numbers without logging in. The issue was fixed in version 10.0.42.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
OneUptime monitoring platform, versions earlier than 10.0.42, used by organizations that rely on its notification and phone‑number management features.
Real-world impact
An attacker could spam users, send phishing messages, or purchase phone numbers to impersonate legitimate contacts, potentially causing financial loss or reputational damage.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no authentication, and can cause complete confidentiality and integrity loss for the platform’s notification system.
What to do about it
- 01Upgrade OneUptime to version 10.0.42 or later.
- 02Restart the OneUptime service after the upgrade.
NVD-referenced vendor advisory
Timeline
- Apr 2, 2026 · Apr 2, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/OneUptime/oneuptime/commit/…patch
- github.com/OneUptime/oneuptime/release…release notes
- github.com/OneUptime/oneuptime/securit…exploitmitigationvendor advisory