Platform
nodejs
Component
oneuptime
Fixed in
10.0.24
10.0.23
CVE-2026-32306 describes a critical SQL Injection vulnerability discovered in oneuptime, a Node.js-based telemetry aggregation tool. This flaw allows an authenticated attacker to inject malicious SQL code into ClickHouse queries, potentially compromising sensitive telemetry data and enabling remote code execution. The vulnerability affects versions prior to 10.0.23, and a patch has been released to address the issue.
The impact of CVE-2026-32306 is severe due to the direct interpolation of user-controlled parameters into ClickHouse SQL queries without proper sanitization or validation. An attacker can leverage this vulnerability to read all data stored in the ClickHouse database, including telemetry data from all tenants. Furthermore, they can modify this data, potentially leading to data corruption or manipulation. The ability to execute arbitrary SQL opens the door to remote code execution (RCE) via ClickHouse table functions, granting the attacker complete control over the affected system. This vulnerability shares similarities with other SQL injection flaws where direct SQL construction from user input leads to severe consequences.
CVE-2026-32306 was publicly disclosed on 2026-03-13. Its CRITICAL CVSS score indicates a high probability of exploitation. While no public proof-of-concept (PoC) has been released at the time of writing, the ease of exploitation due to the lack of input validation suggests that a PoC is likely to emerge. The vulnerability has not yet been added to the CISA KEV catalog.
Exploit Status
EPSS
0.40% (60% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-32306 is to immediately upgrade oneuptime to version 10.0.23 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the telemetry aggregation API to trusted users only. While not a complete solution, this can reduce the attack surface. Review and audit all ClickHouse user permissions to ensure least privilege access. Monitor ClickHouse logs for suspicious SQL queries that might indicate an ongoing attack. After upgrading, confirm the fix by attempting a SQL injection attack on the telemetry aggregation API and verifying that the input is properly sanitized.
Actualice OneUptime a la versión 10.0.23 o superior. Esta versión corrige la vulnerabilidad de inyección SQL en la API de agregación de telemetría.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-32306 is a critical SQL Injection vulnerability in oneuptime, allowing attackers to inject malicious SQL code into ClickHouse queries, potentially leading to data breaches and remote code execution.
You are affected if you are running oneuptime versions prior to 10.0.23 and have not yet upgraded. This vulnerability impacts authenticated users of the telemetry aggregation API.
Upgrade oneuptime to version 10.0.23 or later to remediate the vulnerability. If immediate upgrade is not possible, restrict access to the telemetry aggregation API and monitor ClickHouse logs.
While no active exploitation has been publicly confirmed, the ease of exploitation suggests a high likelihood of exploitation, and monitoring is crucial.
Refer to the oneuptime project's official release notes and security advisories on their GitHub repository or website for the latest information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.