---
id: CVE-2026-32306
title: OneUptime is a solution for monitoring and managing online services
summary: >-
  OneUptime is a solution for monitoring and managing online services. Prior to
  10.0.23, the telemetry aggregation API accepts user-controlled
  aggregationType, aggregateColumnName, and aggregationTimestampColumnName
  parameters and interpol…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: hackerbay
product: oneuptime
affected:
  - oneuptime < 10.0.23
patched:
  - oneuptime 10.0.23
published: '2026-03-13'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T08:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32306'
references:
  - url: >-
      https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00911
epssPercentile: 0.58698
ingestedAt: '2026-10-07T08:20:03.900Z'
---

## Overview

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.

## Affected

- `oneuptime < 10.0.23`

## Remediation

Upgrade past the affected range:

- `oneuptime 10.0.23`