Uptime Kuma CVE-2026-7182: Sensitive Bearer Token Exposure via Public Status Page with POC

Vulnerability Overview Title: Sensitive Bearer Token Exposure via Public Status Pages When Setting is Enabled Description: When the global application setting is enabled (labeled as "Show URL on status page" in the UI), the public status page API endpoint ( ) returns monitor objects that include the field containing the Bearer token used for HTTP monitoring authentication. This information is accessible to any unauthorized party, thereby exposing credentials used to authenticate the monitoring server. Root Cause: In , lines 119-127, the code conditionally strips sensitive fields from the monitor object but returns the monitor object on the public status page anyway. Scope of Impact Affected Versions: >= 3.3, < 3.9.2 Fixed Version: 3.9.2 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2026-7182 Weaknesses: CWE-200, CWE-522 Remediation Recommended Fix: Always strip the and fields, regardless of the setting. Patch: In , the public status page payload now uses a strict whitelist for monitor display fields. The and other internal fields are not returned, regardless of the setting. If an immediate upgrade is not possible, disable the "Show URL on status page" setting or unpublish the status page until upgrading to 3.9.2. POC Code Negative Case: When is set to , the same request returns for the field—confirming that conditional stripping works when the setting is disabled. Impact This allows any unauthorized user who discovers the public status page URL to extract the Bearer token used for Checkmate server authentication for monitoring HTTP endpoints. 1. Credential Theft: Authentication tokens (API keys, service account tokens) are exposed in plaintext. 2. Lateral Movement: Stolen tokens can be used to access internal APIs. 3. Cloud Service Compromise: Tokens for cloud APIs (AWS, GCP, Azure) are exposed. 4. No Authentication Required: The status page API is publicly accessible. Limiting Factors: Administrator privileges are required to enable the setting (it is by default). The UI label "Show URL on status page" does not indicate that credentials will also be exposed. Credits Thai Son Dinh from VinSOC Labs (R&D)

Goal Reached Thanks to every supporter — we hit 100%!

Uptime Kuma CVE-2026-7182: Sensitive Bearer Token Exposure via Public Status Page with POC

More from this source