CVE-2026-34758 OneUptime: Missing Authentication on Notification Endpoints
Unauthenticated attackers can abuse notification endpoints to send SMS, calls, emails, and WhatsApp messages, or purchase phone numbers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34758?
CVE-2026-34758 is a critical missing authorization vulnerability in oneuptime, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.
Weakness: CWE-306
Which versions are affected by CVE-2026-34758?
It affects 1 product.
Products include Hackerbay Oneuptime.
How do I fix CVE-2026-34758?
No fix has been published for CVE-2026-34758 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34758 exists.
Other vulnerabilities in oneuptime
- CVE-2026-33396 Code injection in oneuptime
- CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
- CVE-2026-30956 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header
- CVE-2026-30957 OneUptime Synthetic Monitor RCE via exposed Playwright browser object
- CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
Sources
Also known as GHSA-q253-6wcm-h8hp.