External risk intelligence

OneUptime Unauthenticated Notification Endpoint Abuse

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-34758

OneUptime is an observability and monitoring platform designed to be web-accessible for managing notifications and alerts. These platforms are typically deployed as externally reachable web applications to ensure monitoring services and administrative interfaces are accessible, making the endpoints for notification management commonly exposed in standard deployments.

Missing Authentication

Hackerbay Oneuptime

before 10.0.40

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the OneUptime monitoring platform. Prior to a recent patch, unauthenticated users could exploit access to notification test and phone number management functions. This could lead to unauthorized use of SMS, call, or email services and potential phone number purchases, impacting platform integrity and resource availability.

Unauthenticated access to notification features.
Abuse of communication services is possible.
Confirm OneUptime relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable components of OneUptime by leveraging its network accessibility. Since the notification test and phone number management endpoints are exposed without requiring authentication, an attacker can directly interact with them to abuse SMS, call, email, and WhatsApp services. This could also lead to unauthorized phone number purchases.

No authentication required.
Access notification and phone management endpoints.
Abuse communication services and purchase numbers.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to abuse notification channels, such as SMS, calls, emails, and WhatsApp. This abuse could also lead to the purchase of phone numbers.

Notification services and phone number data at risk.
Unauthenticated access to specific endpoints.
Abuse of communication services and unauthorized purchases.

Operational Fix

Recommended remediation, mitigation, and detection steps

For OneUptime, the platform or application owner is likely responsible for addressing this vulnerability, with support from infrastructure or security teams. The initial practical step involves identifying all OneUptime instances, assessing their exposure and business criticality, and confirming the accountable owner before planning remediation.

Platform/Application owner should address.
Verify OneUptime instance exposure and criticality.
Coordinate remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OneUptime?

OneUptime is an open-source observability and monitoring platform. Teams use it to track infrastructure health, manage system alerts, and centralize incident notifications across various communication channels like SMS, email, and messaging services.

What does CWE-306 mean for CVE-2026-34758?

CWE-306 refers to 'Missing Authentication for Critical Function.' In the context of this vulnerability, it means the software performs sensitive actions—such as managing notification settings or purchasing phone numbers—without verifying the identity of the user requesting those actions.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending requests directly to the unauthenticated notification test or phone management endpoints. If the system is reachable, no user credentials or prior authorization are required to interact with these features. This does not occur if the platform is properly restricted behind secure access controls that demand authentication before reaching these specific endpoints.

Do I need to worry if my OneUptime instance is internal?

According to Halo Surface Signal, OneUptime is designed to be a web-accessible platform, which often results in these endpoints being exposed to the internet. While internal instances face a lower risk from external actors, any OneUptime installation is potentially affected if the vulnerable endpoints are reachable by unauthorized users on the network.

What is the first step to fix this issue?

Your first step is to identify all running instances of OneUptime in your environment. Once identified, verify if they are on a version earlier than 10.0.42. If so, coordinate with your team to update to version 10.0.42 or later to apply the official patch, which introduces the necessary authentication requirements to secure these endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.