Home / Vulnerability Intelligence / CVE-2026-32306

CVE-2026-32306 - Vulnerability Analysis

CriticalCVSS: 9.9

Last Updated: March 13, 2026

OneUptime - SQL Injection

Published: March 13, 2026Updated: March 13, 2026Remote Exploitable

Overview

OneUptime < 10.0.23 contains a SQL injection caused by unsanitized user-controlled parameters in telemetry aggregation API, letting authenticated users execute arbitrary SQL including data read, modification, and potential remote code execution.

Severity & Score

Severity: Critical

CVSS Score: 9.9

EPSS Score: 22.9%(Probability of exploitation in next 30 days)

Impact

Authenticated users can execute arbitrary SQL, read and modify all tenant telemetry data, and potentially execute remote code on the database server.

Mitigation

Update to version 10.0.23 or later.

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🔴 CVE-2026-32306 - Critical (9.9) OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32306/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32306
Severity: Critical
CVSS Score: 9.9
Type: sql_injection
Status: new
EPSS: 22.9%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score

22.9%Probability of exploitation in the next 30 days