CVE-2026-32306 - Vulnerability Analysis

Overview

OneUptime < 10.0.23 contains a SQL injection caused by unsanitized user-controlled parameters in telemetry aggregation API, letting authenticated users execute arbitrary SQL including data read, modification, and potential remote code execution.

Severity & Score

Impact

Authenticated users can execute arbitrary SQL, read and modify all tenant telemetry data, and potentially execute remote code on the database server.

Mitigation

Update to version 10.0.23 or later.

References

• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🟠 CVE-2026-33142 - High (8.1) OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33142/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner