Is CVE-2026-34759 actively exploited?

CVE-2026-34759 has no public evidence of in-the-wild exploitation as of 2026-04-13.

What is the CVSS score for CVE-2026-34759?

CVE-2026-34759 has a CVSS score of 9.2 (CRITICAL severity). Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2026-34759?

Patch guidance is available from hackerbay security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-34759.

Which products are affected by CVE-2026-34759?

1 product: hackerbay oneuptime.

Fix CVE-2026-34759 - CRITICAL hackerbay oneuptime

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: high
Privileges: none
User Action: none
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-862 · Missing Authorization

Metadata

Primary Vendor: HACKERBAY
Published: 4/2/2026
Last Modified: 4/13/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

hackerbay : oneuptime

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-34759. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-34759

View on NIST NVD

CVE-2026-34759 vulnerability