CVEvulnerability
CVE-2026-112047
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-10-18
- Last modified
- 2026-10-19
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-863
Description
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207 github.com
- https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452 github.com
- https://github.com/OneUptime/oneuptime/releases/tag/14.0.69 github.com
- https://github.com/OneUptime/oneuptime/security/advisories/GHSA-8fph-9j9f-xxgc github.com
- https://www.vulncheck.com/advisories/oneuptime-14.0.2-before-14.0.69-incorrect-authorization-in-kubernetes-ai-actions www.vulncheck.com