Incorrect Authorization in OneUptime Cloud Management Platform

CVE-2026-112047

What is CVE-2026-112047?

An incorrect authorization vulnerability in OneUptime versions prior to 14.0.69 allows authenticated project members to exploit project-wide permissions. This can lead to unauthorized actions on clusters, such as calling AI access tests, resetting agents, approving kubectl changes, and running commands on resources outside their assigned scope. Attackers can leverage these flaws to gain insights into agent RBAC permissions and perform actions that compromise the security and integrity of the environment.

References