CVE-2026-35053

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.

• CWE-306

• https://github.com/OneUptime/oneuptime/releases/tag/10.0.42Product, Release Notes
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7Exploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35048The Piwigo installer in versions 16.3.0 and earlier accepts …9.8
• CVE-2026-35049wire-ios is an iOS client for the Wire secure messaging appl…6.5
• CVE-2026-3505Allocation of resources without limits or throttling, Uncont…7.5
• CVE-2026-35050text-generation-webui is an open-source web interface for ru…8.8
• CVE-2026-35051Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-35052D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2026-35054XenForo before 2.3.9 is vulnerable to stored cross-site scri…5.4
• CVE-2026-35055XenForo before 2.3.9 and before 2.2.18 is vulnerable to cros…6.1
• CVE-2026-35056XenForo before 2.3.9 and before 2.2.18 allows remote code ex…8.6
• CVE-2026-35057XenForo before 2.3.10 and before 2.2.19 is vulnerable to sto…5.4
• CVE-2026-35058Improper validation of packet length during tls-crypt-v2 key…6.5
• CVE-2026-3506The WP-Chatbot for Messenger plugin for WordPress is vulnera…5.3