CVE-2026-29779: Uptimeflare Information Disclosure Flaw

CVE-2026-29779 Overview

CVE-2026-29779 is an Information Exposure vulnerability affecting UptimeFlare, a serverless uptime monitoring and status page solution powered by Cloudflare Workers. The vulnerability arises from improper separation of client-side and server-side configuration exports, resulting in sensitive server configuration data being exposed to all visitors through the client-side JavaScript bundle.

Prior to commit 377a596, the configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors.

Critical Impact
Sensitive server-side configuration data, potentially including API keys, credentials, and internal endpoints, is exposed to all website visitors through the publicly accessible JavaScript bundle.

Affected Products

lyc8503 UptimeFlare (versions prior to commit 377a596)

Discovery Timeline

2026-03-07 - CVE-2026-29779 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29779

Vulnerability Analysis

This vulnerability represents a classic case of improper client-server boundary enforcement in modern JavaScript applications. The root issue stems from the architectural decision to export both client-safe and server-only configuration from a single module. When the incidents.tsx page component imported workerConfig, the JavaScript bundler (likely used with Next.js or similar frameworks) had no mechanism to exclude this server-side configuration from the client bundle.

The impact is significant because workerConfig typically contains sensitive operational data that should never be exposed to end users. This could include monitoring endpoint configurations, authentication tokens for upstream services, webhook secrets, notification service credentials, and other operational secrets required for the serverless worker to function.

Root Cause

The vulnerability originates from a violation of the principle of least privilege in module design. By co-locating client and server configuration exports in uptime.config.ts, the codebase created an easy path for developers to accidentally import server-side secrets into client-rendered components. The pages/incidents.tsx file incorrectly imported workerConfig for use in a client-side component, and modern JavaScript bundlers included all referenced code in the final client bundle.

Attack Vector

An attacker can exploit this vulnerability through the following mechanism:

Visit any UptimeFlare status page deployment running a vulnerable version
Open browser developer tools and navigate to the Sources or Network tab
Inspect the JavaScript bundle files served to the client
Search for workerConfig or known configuration property names
Extract sensitive configuration data including potential API keys, credentials, and internal endpoints

The exploitation requires no authentication and can be performed by any visitor to the status page. The attack is passive in nature—the sensitive data is already present in the publicly served JavaScript files.

Detection Methods for CVE-2026-29779

Indicators of Compromise

Unusual access patterns to JavaScript bundle files from automated tools or scanners
Evidence of bulk downloading of static assets from status page deployments
Unauthorized use of API keys or credentials that were present in workerConfig
Suspicious activity on third-party services integrated with UptimeFlare using leaked credentials

Detection Strategies

Review JavaScript bundle contents in production deployments for exposed workerConfig data
Implement Content Security Policy monitoring to detect unusual script analysis
Audit access logs for patterns consistent with automated secret extraction
Search for exposed credentials in public secret scanning databases and paste sites

Monitoring Recommendations

Enable logging for all API key and credential usage across integrated services
Set up alerts for authentication from unexpected IP addresses or geographic locations
Monitor for unauthorized modifications to monitoring configurations
Implement regular secret rotation and track credential usage patterns

How to Mitigate CVE-2026-29779

Immediate Actions Required

Update UptimeFlare to a version including commit 377a596 or later
Rotate all secrets and credentials that may have been present in workerConfig
Review access logs for any services that may have had credentials exposed
Audit other configuration files for similar client/server boundary violations

Patch Information

The vulnerability has been patched via commit 377a596. Organizations running UptimeFlare should update to include this fix immediately. The patch properly separates client-safe and server-only configuration to prevent bundler inclusion of sensitive data.

For detailed patch information, refer to the GitHub Commit and the GitHub Security Advisory GHSA-36q9-v7p3-vj6v.

Workarounds

If immediate patching is not possible, manually separate configuration files to ensure server-only config is never importable from client code
Implement build-time checks to detect server configuration imports in client-side code paths
Use environment variable injection at runtime rather than bundled configuration for sensitive values
Consider temporarily disabling public access to status pages until the patch can be applied

bash

# Verify your UptimeFlare version includes the security fix
git log --oneline | grep -i "377a596"

# Check for exposed config in built JavaScript bundles
grep -r "workerConfig" .next/static/chunks/ 2>/dev/null