Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112047— OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

Quick assessment

Affected
OneUptime oneuptime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OneUptime 14.0.2 至 14.0.69（不含）版本中存在一个授权验证错误漏洞。该漏洞允许已认证的项目成员利用项目范围的权限检查机制，对超出其授权范围的集群执行操作。攻击者可利用此漏洞调用 AI 访问测试、代理重置、kubectl 计划审批以及事件 AI 对话等功能，从而探测代理的 RBAC 权限、断开代理连接、审批 kubectl 变更，或在未授权资源上执行命令。

CVSS 5.4 · Medium

Possible ATT&CK Techniques 2 AI

T1068.001 T1068.002

Affected Version Matrix 1

VendorProduct Version RangeStatus
OneUptime oneuptime 14.0.2< 14.0.69 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112047

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
Source: CVE Program / CVE List V5
Vulnerability Description
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OneUptime oneuptime 14.0.2 ~ 14.0.69 -

II. Public POCs for CVE-2026-112047

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112047

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112047 (2)

Vendor Pages for CVE-2026-112047 (1)

IV. Related Vulnerabilities

Same product: oneuptime
Same vendor: OneUptime
Same weakness: CWE-863

V. Comments for CVE-2026-112047

No comments yet

Leave a comment