---
id: CVE-2026-112047
title: >-
  OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI
  Actions
summary: >-
  OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization
  vulnerability that allows authenticated project members to act on clusters
  outside their scope by exploiting project-wide permission checks. Attackers
  can call the AI ac…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: OneUptime
product: oneuptime
affected:
  - oneuptime >= 14.0.2 < 14.0.69
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T12:19:36.162Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112047'
references:
  - url: >-
      https://github.com/OneUptime/oneuptime/security/advisories/GHSA-8fph-9j9f-xxgc
    label: GitHub Security Advisory (GHSA-8fph-9j9f-xxgc)
  - url: >-
      https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452
  - url: 'https://github.com/OneUptime/oneuptime/releases/tag/14.0.69'
    label: oneuptime 14.0.69 Release Notes
  - url: >-
      https://github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207
  - url: >-
      https://www.vulncheck.com/advisories/oneuptime-14.0.2-before-14.0.69-incorrect-authorization-in-kubernetes-ai-actions
    label: >-
      VulnCheck Advisory: OneUptime 14.0.2 before 14.0.69 Incorrect
      Authorization in Kubernetes AI Actions
tags:
  - cve.org
ingestedAt: '2026-10-18T12:41:54.063Z'
---

## Overview

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

## Affected

- `oneuptime >= 14.0.2 < 14.0.69`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.