Open Source Monitoring Platform Vulnerability in OneUptime

CVE-2026-34759

What is CVE-2026-34759?

OneUptime, an open-source monitoring and observability platform, has a vulnerability concerning its notification API endpoints. Prior to version 10.0.42, multiple endpoints are accessible without proper authentication middleware. Unlike their counterparts that use robust authorization measures, these unsecured endpoints can be exploited by an unauthenticated attacker. By leveraging information leaks from the public Status Page API, the attacker can gain unauthorized access to a victim's Twilio account, enabling them to purchase phone numbers or delete existing alerting numbers. This significant oversight poses serious security risks, emphasizing the need for proper authentication controls, which have been addressed in the latest version.

References