External risk intelligence

OneUptime Worker API Unauthenticated Workflow Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-35053

OneUptime is a monitoring and observability platform often deployed as a web-based service. The vulnerable endpoints are part of the API layer intended for workflow management, which in many common deployments of such platforms, are exposed to allow for external integration and automation, making them likely to be reachable from the internet.

Missing Authentication

Hackerbay Oneuptime

before 10.0.42

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated exposure in the OneUptime Worker service, which could allow an attacker to trigger arbitrary workflows with controlled input. This could lead to the execution of JavaScript code, abuse of notification systems, or manipulation of data. The issue has been addressed in a recent version of the platform.

Unauthenticated access to workflow execution.
Affects operational platforms with external integrations.
Verify OneUptime usage and confirm patch application.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by sending a request to specific workflow execution endpoints within the OneUptime Worker service. If an attacker can guess or obtain a valid workflow ID, they can then execute arbitrary workflows, potentially leading to the execution of attacker-controlled JavaScript code, abuse of notification systems, or unauthorized data modification.

Reachable endpoints without authentication.
Guesses workflow ID to trigger execution.
Leads to code execution and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the Worker service's ManualAPI could allow an attacker to execute arbitrary workflows by guessing or obtaining a workflow ID. This could lead to JavaScript code execution, abuse of notification systems, or manipulation of data within the OneUptime platform.

Workflow execution and system data
Triggering workflows with crafted input
Unauthorized code execution and data changes

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in the OneUptime Worker service, as it exposes unauthenticated API endpoints that could allow for arbitrary workflow execution and code injection. The first practical step is to identify all OneUptime deployments, confirm their reachability and criticality, and then coordinate remediation efforts with the accountable owners, potentially involving vendor consultation for patching or implementing compensating controls.

Identify accountable OneUptime owners.
Verify reachability and criticality of instances.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OneUptime?

OneUptime is an open-source platform designed for system monitoring and observability. Organizations use it to track infrastructure health, automate tasks, and manage incident workflows. It is built to integrate with various services to provide visibility into operational status and performance metrics.

What does CVE-2026-35053 mean for system security?

This vulnerability is classified as CWE-306, which refers to a missing authentication for critical function. In the context of OneUptime, the Worker service fails to verify user identity before processing workflow requests. This allows an unauthorized person to act as if they are a legitimate administrator, potentially running arbitrary JavaScript, changing data, or misusing notification features.

How can an attacker trigger this vulnerability?

An attacker needs to send a request to specific workflow execution endpoints. The primary precondition is knowing or guessing a valid workflow ID. This issue is not triggered by standard, authenticated user activity, nor does it affect workflows that are not reachable through the ManualAPI endpoints in the affected versions.

Why should I care if my OneUptime instance is internet-facing?

Halo Surface Signal indicates that OneUptime is often deployed in ways that expose API layers to the internet to support automation and external integrations. If your instance is reachable from the public internet, the risk increases because unauthorized actors can reach these unauthenticated endpoints directly without needing internal network access.

Do I need to update my software to fix this?

Yes. The first step is to identify all running instances of the platform and confirm their version numbers. Since this is an authentication bypass, the primary remediation is to upgrade to version 10.0.42 or later, where the vendor has added the necessary authentication middleware to protect the workflow execution endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.