CVE-2026-35053 is a critical missing authentication flaw in OneUptime, an open source monitoring platform. NVD scores it 9.8. Workflow run endpoints in the Worker service need no login. Upgrade to OneUptime 10.0.42 or later. Keep the Worker service off public networks while you upgrade.
What's affected
OneUptime before 10.0.42. The fixed release is 10.0.42.
The record says the Worker service's ManualAPI exposes workflow execution endpoints over GET and POST without any authentication middleware. An attacker needs to obtain or guess a workflow ID.
How to check if you're exposed
Check your OneUptime version in the dashboard or through the image tag:
docker ps | grep -i oneuptime
Then see whether the Worker service port is reachable beyond your private network. Review access logs for requests to the manual workflow run path from unknown addresses.
What to do now
- Upgrade OneUptime to 10.0.42 or later.
- Make sure the Worker service is not exposed to the internet. Internal services should sit behind the platform's gateway.
- Review workflows that run JavaScript or send notifications, since those are what a caller could trigger.
- Rotate secrets used inside workflows if you see unexpected runs.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The endpoints that run workflows did not check who was calling. Because workflows can run JavaScript and send notifications, the record lists code execution, notification abuse and data manipulation as impacts.
Workflow IDs are not secrets. Treating an identifier as if it were a password is a common design mistake, and an authentication check on the endpoint is the right fix.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Internal services are designed to be reached by other services, so authentication often gets skipped on the assumption that the network protects them. Assumptions like that break when a port is published by mistake. Check your compose files and load balancer rules to confirm only the public gateway is reachable from outside, and review workflow permissions.
Quick check
Is guessing a workflow ID realistic?
The record says an attacker needs to obtain or guess one. IDs can leak through logs, links and screenshots, so do not count on them staying private.
Sources
Last reviewed: 19 October 2026.
