CVE-2026-27574: OneUptime: node:vm sandbox escape in monitor probe leads to RCE
OneUptime versions 9.5.13 and below run custom JavaScript monitors inside Node.js's node:vm module, which its documentation says is not a security mechanism, so a user with monitor-creation rights can escape the sandbox and execute code on the probe. The advisory states the probe runs with host networking and holds cluster credentials, which it says enables full cluster compromise; the issue is rated critical and fixed in 10.0.5. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
OneUptime is a platform for monitoring and managing online services. According to the GitHub Security Advisory, its custom JavaScript monitor feature executes user-supplied code using Node.js's node:vm module, which the Node.js documentation describes as not being a security mechanism. The advisory describes the sandbox as escapable and the weakness as CWE-94 (Code Injection).
Impact
The advisory states that a successful escape gives full access to the underlying probe process. It also states that the probe runs with host networking and holds cluster credentials in its environment, so the advisory concludes that an attacker could fully compromise the cluster. Because the advisory says monitor creation is available to the lowest project role and open registration is enabled by default, it describes the attack as achievable by an anonymous user in about 30 seconds.
- Confidentiality, integrity and availability are all rated high in the CVSS vector.
- The advisory rates the issue critical; the CVSS scores provided are 9.9 and 10 depending on the source.
Affected products and versions
- OneUptime, versions 9.5.13 and below, according to the advisory description.
- The affected range in the record is listed as before 10.0.5 under two product names (Hackerbay Oneuptime and OneUptime Oneuptime).
- The fixed version is 10.0.5.
Exploitation status
CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The NVD reference list includes an entry tagged as Exploit, and the SSVC record lists exploitation as proof of concept, which indicates public exploit material may exist but does not establish active attacks.
Remediation and mitigation
- Upgrade OneUptime to version 10.0.5 or later, which the record identifies as the fixed release. The fix commit is referenced in the record.
- If an immediate upgrade is not possible, reduce exposure by disabling open registration, limiting who can create or edit custom monitors, and reviewing project membership.
- Treat credentials available to the probe as exposed until rotation is confirmed, and consider rotating the secrets the advisory lists after upgrading.
- Isolate probe hosts from sensitive internal networks where the deployment allows it, since the advisory highlights host networking as an amplifying factor.
Detection guidance
- Review account registration logs and recently created users or project memberships for unexpected activity.
- Audit recently created or modified custom JavaScript monitors, looking for code that was not authored by the operations team.
- Monitor probe hosts for unexpected child processes, outbound connections or access to configuration secrets, at a general level.
Limitations of the available information
- The record does not state the exact boundary between 9.5.13 and 10.0.5; the description says 9.5.13 and below, while the affected range says before 10.0.5. Versions in that gap are not addressed by the sources consulted.
- The record does not provide details on which deployments were affected in practice or whether any compromise has been observed.
- Exploit reference contents were not part of the record, so their availability and maturity cannot be assessed here.
Frequently asked questions
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The NVD references include an entry tagged as Exploit and SSVC lists exploitation as proof of concept, but these do not confirm active attacks.
Which version fixes the issue?
According to the record, the issue is fixed in version 10.0.5. Versions 9.5.13 and below are described as affected.
What can operators do if they cannot upgrade right away?
Reduce exposure by disabling open registration, limiting who can create or edit custom monitors, reviewing project memberships, and treating probe credentials as exposed until they are rotated. Upgrading to 10.0.5 remains the main remediation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.