{"id":"CVE-2026-32306","sourceIdentifier":"security-advisories@github.com","published":"2026-03-13T19:54:42.000","lastModified":"2026-10-07T08:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as \"trusted SQL\"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23."},{"lang":"es","value":"OneUptime es una solución para monitorear y gestionar servicios en línea. Antes de la 10.0.23, la API de agregación de telemetría acepta los parámetros controlados por el usuario aggregationType, aggregateColumnName y aggregationTimestampColumnName y los interpola directamente en las consultas SQL de ClickHouse a través del método .append() (documentado como 'SQL de confianza'). No hay lista blanca, no hay enlace de consulta parametrizada y no hay validación de entrada. Un usuario autenticado puede inyectar SQL arbitrario en ClickHouse, lo que permite la lectura completa de la base de datos (incluidos los datos de telemetría de todos los inquilinos), la modificación de datos y la potencial ejecución remota de código a través de funciones de tabla de ClickHouse. Esta vulnerabilidad está corregida en la 10.0.23."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OneUptime","product":"oneuptime","versions":[{"version":"< 10.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-14T03:42:10.455865Z","id":"CVE-2026-32306","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.23","matchCriteriaId":"AF2F89C2-1AB8-4611-9B0B-A4CFA02C807E"}]}]}],"references":[{"url":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]}]}