CVE-2026-112047

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112047

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112047.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112047

Aliases

GHSA-8fph-9j9f-xxgc

Published

2026-10-18T12:19:36Z

Modified

2026-10-21T02:55:50Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

Details

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112047.json"
}

References

Affected packages

Git / github.com/oneuptime/oneuptime

Affected ranges

Type

GIT

Repo

https://github.com/oneuptime/oneuptime

Events

Introduced

1d7aa5c5e8edde63d2e10a2ad8cd4788d8c3d6df

Fixed

ce585ba9acdaf71d0e836bb7d32e1f7e80281cc1

Fixed

264e1ba13149cbd4c80cb22f2177b405886b0452

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "14.0.2"
                },
                {
                    "fixed":  "14.0.69"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "264e1ba13149cbd4c80cb22f2177b405886b0452"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "14.0.69",
            "range":  [
                {
                    "fixed":  "ce585ba9acdaf71d0e836bb7d32e1f7e80281cc1"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

14.*

14.0.10

14.0.11

14.0.12

14.0.13

14.0.2

14.0.3

14.0.5

14.0.6

14.0.7

14.0.8

14.0.9

Other

build-number-8820

build-number-8826

build-number-8839

build-number-8845

build-number-8859

build-number-8861

build-number-8867

build-number-8872

build-number-8873

build-number-8898

build-number-8905

build-number-8920

build-number-8926

build-number-8937

build-number-8942

build-number-8966

build-number-8971

build-number-8982

build-number-8984

build-number-8989

build-number-9005

build-number-9007

build-number-9015

build-number-9020

build-number-9029

build-number-9035

build-number-9037

build-number-9051

build-number-9060

build-number-9074

build-number-9077

build-number-9097

build-number-9098

build-number-9105

build-number-9108

build-number-9132

build-number-9142

build-number-9151

build-number-9162

build-number-9168

build-number-9178

build-number-9183

build-number-9195

build-number-9212

build-number-9220

build-number-9224

build-number-9232

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112047.json"