Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119552Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Medium 4.8
In plain English
A medium-severity security flaw in uptime-kuma from louislam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| louislam | uptime-kuma | 0 – through 2.5.8 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722 technical-description
- https://abraxaslabs.tech/research/uptime-kuma-setup-toctou third-party-advisory
- https://github.com/louislam/uptime-kuma product
- VulnCheck Advisory: Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler third-party-advisory