CVE-2026-32306: OneUptime SQL Injection Vulnerability in ClickHouse Aggregation API
Summary
CVE-2026-32306: OneUptime ClickHouse SQL Injection via Aggregate Query Parameters. Affects oneuptime versions < 10.0.23. Fixed in 10.0.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is an open-source platform designed for monitoring and managing application performance, providing telemetry data such as logs, traces, and metrics. It utilizes ClickHouse, a columnar database management system, for efficient data storage and querying. However, a critical vulnerability exists in its telemetry aggregation API, which allows for SQL injection attacks due to inadequate input validation.
Vulnerability Detail
The vulnerability arises from the telemetry aggregation API's handling of user-controlled parameters: aggregationType, aggregateColumnName, and aggregationTimestampColumnName. These parameters are directly interpolated into ClickHouse SQL queries without any validation or allowlisting. An authenticated user can exploit this flaw to inject arbitrary SQL, leading to unauthorized access to sensitive data across all tenants, data manipulation, and potential remote code execution. The lack of input validation and the use of raw SQL concatenation are significant technical aspects that contribute to this vulnerability.
How To Fix
Minimum fixed version
10.0.23
This is the first release that contains the fix.
npm install oneuptime@10.0.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the aggregation API endpoints to trusted users only until the patch is applied. Additionally, monitor and log API requests for any suspicious activity.
Conclusion
CVE-2026-32306 represents a significant security risk for OneUptime users, allowing for SQL injection attacks that can compromise sensitive data and system integrity. Immediate action is recommended to update the package and implement the suggested code fixes to mitigate this vulnerability.
See every vulnerability recorded for oneuptime →
FAQ
CVE-2026-32306 is a critical SQL injection vulnerability in the OneUptime platform that allows authenticated users to execute arbitrary SQL queries against the ClickHouse database.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to unauthorized data access across all tenants, data manipulation, server-side file reads, remote code execution, and credential theft.
To update to the patched version, run the command 'npm install oneuptime@10.0.23' in your project directory.
If immediate updates are not possible, implement access restrictions to the affected API endpoints and monitor for any unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for oneuptime.
