Race Condition Vulnerability in Uptime Kuma by Louis Lam

CVE-2026-119552

What is CVE-2026-119552?

Uptime Kuma version 2.5.8 is vulnerable to a race condition in the Socket.IO first-run setup handler. This flaw enables unauthenticated attackers to exploit concurrent setup requests during the bcrypt hashing process. By bypassing the verification of an empty user table, attackers can create unauthorized administrator accounts. Once an attacker gains administrative privileges, they may alter monitors, manipulate API keys, and control authentication settings, significantly compromising the security of the application.

References