CVE-2026-112047: oneuptime 14.0.2 to before 14.0.69

Affected technology

oneuptime · 14.0.2 to before 14.0.69
OneUptime

Description’s affected range: before 14.0.69

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as low; availability impact as none.