CVE-2026-112047
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
| CWE | CWE-863 |
| Vendor | oneuptime |
| Product | oneuptime |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for oneuptime oneuptime
Be the first to know when new medium vulnerabilities affecting oneuptime oneuptime are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
OneUptime / oneuptime
14.0.2 < 14.0.69
References
github.com: https://github.com/OneUptime/oneuptime/security/advisories/GHSA-8fph-9j9f-xxgc github.com: https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452 github.com: https://github.com/OneUptime/oneuptime/releases/tag/14.0.69 github.com: https://github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207 vulncheck.com: https://www.vulncheck.com/advisories/oneuptime-14.0.2-before-14.0.69-incorrect-authorization-in-kubernetes-ai-actions
Credits
George Chen