Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-112047OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

Medium 5.4

In plain English

A medium-severity incorrect authorization in oneuptime from OneUptime. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

Affected products (as reported)

Vendor	Product	Versions
OneUptime	oneuptime	14.0.2 – before 14.0.69

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-8fph-9j9f-xxgc) vendor-advisory
https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452 patch
oneuptime 14.0.69 Release Notes release-notes
https://github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207 technical-description
VulnCheck Advisory: OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions third-party-advisory