CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
Authenticated users can bypass project scope restrictions to execute commands and modify resources in unauthorized Kubernetes clusters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112047?
CVE-2026-112047 is a medium-severity missing authorization vulnerability in oneuptime, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
Weakness: CWE-863
Which versions are affected by CVE-2026-112047?
How do I fix CVE-2026-112047?
No fix has been published for CVE-2026-112047 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-112047 being exploited?
There is no known exploitation of CVE-2026-112047 in the wild and no public exploit code.
Sources
Also known as GHSA-8fph-9j9f-xxgc, GHSA-j2m9-x4vf-qv28.