CVE-2026-119552
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
| CWE | CWE-367 |
| Vendor | louislam |
| Product | uptime-kuma |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for louislam uptime-kuma
Be the first to know when new medium vulnerabilities affecting louislam uptime-kuma are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
louislam / uptime-kuma
0 ≤ 2.5.8
References
github.com: https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722 abraxaslabs.tech: https://abraxaslabs.tech/research/uptime-kuma-setup-toctou github.com: https://github.com/louislam/uptime-kuma vulncheck.com: https://www.vulncheck.com/advisories/uptime-kuma-through-2.5.8-race-condition-admin-creation-via-setup-handler
Credits
Abraxas Labs