CVE-2026-34759
OneUptime, an open‑source monitoring platform, had several notification API endpoints exposed without authentication before version 10.0.42. An attacker could call these endpoints through the Nginx proxy and, using a leaked projectId, purchase phone numbers on the victim’s Twilio account and delete all existing alerting numbers. The issue was fixed in OneUptime 10.0.42.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
OneUptime versions prior to 10.0.42, used by organizations running the open‑source monitoring platform (CPE: hackerbay oneuptime).
Real-world impact
An unauthenticated attacker could hijack the victim’s Twilio account to buy new phone numbers and remove all configured alerting numbers, effectively disabling monitoring alerts and potentially causing operational disruptions.
Why this severity
The CVSS score of 9.2 reflects that the vulnerability allows remote unauthenticated exploitation with high impact on confidentiality, integrity, and availability. The attacker can gain full control over alerting numbers, leading to loss of monitoring and potential service outages.
What to do about it
- 01Upgrade OneUptime to version 10.0.42 or later.
- 02Restart the OneUptime service to apply the update.
- 03Verify that the /notification/ endpoints are no longer accessible without authentication.
NVD-referenced vendor advisory
Timeline
- Apr 2, 2026 · Apr 2, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/OneUptime/oneuptime/commit/…patch
- github.com/OneUptime/oneuptime/release…productrelease notes
- github.com/OneUptime/oneuptime/securit…exploitmitigationvendor advisory