Detections
Analytics

SCA: security update for oneuptime (GHSA-gcg3-c5p2-cqgg)

high Tenable Cloud Security Plugin ID 438938

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for
 CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to
 the _aggregateBy method but did not apply the same validation to three other query construction paths in
 StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-
 controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters
 without verifying they correspond to actual model columns. ClickHouse Identifier parameters are
 substituted directly into queries without escaping, so an attacker who can reach any analytics list or
 aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. This issue has
 been patched in version 10.0.34. (CVE-2026-33142)

Solution

Update the oneuptime library and its related packages to version 10.0.34 or later.

See Also

https://github.com/advisories/GHSA-gcg3-c5p2-cqgg

Plugin Details

Severity: High

ID: 438938

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 3/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.81

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-33142

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/18/2026

Vulnerability Publication Date: 3/18/2026

Reference Information

CVE: CVE-2026-33142

cwe: CWE-89