OneUptime 14.0.69 Fixes Kubernetes AI Authorization Bypass
Tech GuruQuick Answer
OneUptime published GHSA-8fph-9j9f-xxgc, mapped by the CNA to CVE-2026-112047, for resource-level authorization gaps in Kubernetes and infrastructure AI workflows. Deployments on 14.0.2 through 14.0.68 should upgrade to 14.0.69 or later, verify scoped roles against each target resource, review relevant activity, and retain evidence.
Upgrade OneUptime And Revalidate Resource-Scoped AI Access
What to do now: Inventory OneUptime versions and AI-enabled clusters or infrastructure resources, map users and service accounts with scoped project access, upgrade to 14.0.69 or later, test each affected action against allowed and denied resources, review historical activity, and preserve evidence.
Last verified: 2026-10-18 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OneUptime 14.0.2 through 14.0.68 with Kubernetes or infrastructure AI features enabled |
|---|---|
| Advisory | GHSA-8fph-9j9f-xxgc / CVE-2026-112047 / OneUptime 14.0.69 |
| CVE | CVE-2026-112047 |
| Authoritative release date | 2026-10-18 04:53:37 UTC; initial OneUptime GitHub Security Advisory publication, one minute after the 14.0.69 release |
| Authority revision date | 2026-10-18 12:19:36.162 UTC; the CNA record assigned CVE-2026-112047 after the maintainer advisory's 04:53:38 UTC update |
| Affected versions | OneUptime 14.0.2 through 14.0.68 where authenticated project members have label-, owner-, block-, custom-role-, or read-only-scoped access and can reach Kubernetes AI tests, agent reset, AI plan approval, or incident and alert investigation workflows. |
| Fixed version | OneUptime 14.0.69 or later |
| CVSS base score | 5.4 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by OneUptime or the CNA; no exploitation claim is inferred. |
What Changed
OneUptime 14.0.69 makes access decisions for the specific cluster or infrastructure resource. Test connection, Reset agent, and kubectl-plan approval now require edit access to the target, while incident and alert AI conversations expose commands only for resources the requesting user may view.
What To Validate Now
- Inventory. Identify OneUptime deployments on 14.0.2 through 14.0.68, Kubernetes clusters and infrastructure resources with AI investigation enabled, AI agents and Runners, and members whose access is limited by labels, ownership, blocks, custom roles, or read-only credentials.
- Establish applicability. Focus on authenticated members who can view a target or related incident or alert but should not edit that cluster or resource. Check Kubernetes AI access tests, cluster and infrastructure agent resets, approval of AI-proposed kubectl plans, and AI investigation commands on linked resources.
- Remediate. Upgrade through OneUptime's supported process to 14.0.69 or later. Until the upgrade is complete, remove cluster-edit permission from narrowly scoped members, restrict AI administration and runbook-start permissions to users allowed to edit every relevant target, and disable AI investigation on resources not visible to all intended incident or alert readers.
- Validate. Confirm 14.0.69 or later in the running deployment; test allowed and denied users against each affected workflow; verify label, owner, block, custom-role, and read-only constraints; confirm agents reconnect after authorized resets; review audit, incident, alert, Runner, and cluster activity; and verify rollback readiness.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The issue requires an authenticated project member and depends on configured permissions and AI features; deployment version alone does not prove exposure or misuse. Test real scoped-role combinations after upgrading, protect investigation records, and do not infer exploitation from the CVSS score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
