CVE-2026-112047GHSA-8fph-9j9f-xxgc
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
OneUptime oneuptime
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 14.0.69oneuptimeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
Text from CVE List
Affected versions 1
- oneuptimeaffected: 14.0.2 before 14.0.69CVE List
References 5
- github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452Fixvia CVE List
- github.com/OneUptime/oneuptime/releases/tag/14.0.69Fixvia CVE List
- github.com/OneUptime/oneuptime/security/advisories/GHSA-8fph-9j9f-xxgcAdvisoryvia CVE List
- vulncheck.com/advisories/oneuptime-14.0.2-before-14.0.69-incorrect-authorization-in-kubernetes-ai-actionsAdvisoryvia CVE List
- github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207Referencevia CVE List