CVE-2026-33142

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns. ClickHouse Identifier parameters are substituted directly into queries without escaping, so an attacker who can reach any analytics list or aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. This issue has been patched in version 10.0.34.

• CWE-89

• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gcg3-c5p2-cqggMitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33136WeGIA is a web manager for charitable institutions. Versions…6.1
• CVE-2026-33137XWiki Platform is a generic wiki platform offering runtime s…9.3
• CVE-2026-33139PySpector is a static analysis security testing (SAST) Frame…7.8
• CVE-2026-3314Missing password field masking vulnerability in Hitachi Ops …4.6
• CVE-2026-33140PySpector is a static analysis security testing (SAST) Frame…6.1
• CVE-2026-33141Chamilo LMS is a learning management system. Prior to 2.0.0-…6.5
• CVE-2026-33143OneUptime is a solution for monitoring and managing online s…7.5
• CVE-2026-33144GPAC is an open-source multimedia framework. Prior to commit…7.8
• CVE-2026-33145xrdp is an open source RDP server. Versions through 0.10.5 a…6.3
• CVE-2026-33146Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-33147GMT is an open source collection of command-line tools for m…7.8
• CVE-2026-33148Tandoor Recipes is an application for managing recipes, plan…6.5