CVE-2026-30957: Hackerbay OneUptime RCE Vulnerability

CVE-2026-30957 Overview

CVE-2026-30957 is a Remote Code Execution (RCE) vulnerability affecting OneUptime, an open-source solution for monitoring and managing online services. Prior to version 10.0.21, the OneUptime Synthetic Monitors feature allows a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server or container.

The vulnerability stems from the execution of untrusted Synthetic Monitor code inside Node.js's vm module while live host-realm Playwright browser and page objects remain exposed to the sandboxed code. A malicious user can leverage Playwright APIs on the injected browser object to spawn an attacker-controlled executable, achieving server-side remote code execution without requiring a separate vm sandbox escape.

Critical Impact

Authenticated attackers with low privileges can achieve full remote code execution on OneUptime probe servers, potentially compromising the entire monitoring infrastructure and any systems accessible from the probe container.

Affected Products

• Hackerbay OneUptime versions prior to 10.0.21

Discovery Timeline

• 2026-03-10 - CVE-2026-30957 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30957

Vulnerability Analysis

This vulnerability represents a critical flaw in the security isolation model of OneUptime's Synthetic Monitor feature. The core issue lies in how the application handles user-provided monitoring scripts. While Node.js's vm module provides a degree of code isolation, it was never designed as a security sandbox. When live Playwright browser and page objects from the host realm are injected into this pseudo-sandbox, they become conduits for escaping the intended execution context.

The impact is severe because the Playwright browser automation library provides extensive system interaction capabilities, including the ability to launch processes. An attacker doesn't need to discover a novel vm escape technique; they simply need to call standard Playwright APIs that were inadvertently exposed within the synthetic monitor execution context.

Root Cause

The root cause is the exposure of privileged host-realm Playwright objects (browser and page instances) to untrusted Synthetic Monitor code executed within Node.js's vm module. This architectural decision creates a direct pathway from user-controlled code to system-level operations, as Playwright's APIs include functionality that can spawn arbitrary executables on the underlying system.

Attack Vector

The attack vector involves an authenticated user with low privileges creating a malicious Synthetic Monitor within their project. The attacker crafts monitor code that abuses the exposed Playwright browser object to execute system commands on the oneuptime-probe server.

The exploitation path does not require any additional sandbox escape techniques. By calling legitimate Playwright APIs on the injected browser object, an attacker can instruct the probe to spawn arbitrary executables. This could include reverse shells, cryptocurrency miners, or any other malicious payload, effectively granting the attacker command execution on the probe infrastructure.

For detailed technical analysis of the exploitation mechanism, refer to the GitHub Security Advisory GHSA-jw8q-gjvg-8w4q.

Detection Methods for CVE-2026-30957

Indicators of Compromise

• Unexpected process spawning from the oneuptime-probe container or server
• Unusual network connections originating from probe infrastructure to unknown external hosts
• Synthetic Monitor configurations containing suspicious Playwright API calls or encoded payloads
• Abnormal resource utilization on probe servers indicating malicious activity

Detection Strategies

• Monitor process execution logs on oneuptime-probe servers for unauthorized child processes
• Implement audit logging for Synthetic Monitor creation and modification events
• Review Synthetic Monitor code submissions for suspicious patterns targeting browser object manipulation
• Deploy endpoint detection and response (EDR) solutions on probe infrastructure to detect anomalous behavior

Monitoring Recommendations

• Enable comprehensive logging for all Synthetic Monitor executions including input parameters
• Configure alerts for unusual API call patterns within the monitoring infrastructure
• Implement network segmentation to limit the blast radius if probe servers are compromised
• Regularly audit user permissions to ensure principle of least privilege for project access

How to Mitigate CVE-2026-30957

Immediate Actions Required

• Upgrade OneUptime to version 10.0.21 or later immediately
• Audit existing Synthetic Monitor configurations for potentially malicious code
• Review access logs for suspicious activity from low-privileged users
• Consider temporarily disabling Synthetic Monitor functionality until the patch is applied

Patch Information

The vulnerability is fixed in OneUptime version 10.0.21. The patch addresses the insecure exposure of Playwright objects to user-controlled code within the Synthetic Monitor feature. Organizations should upgrade to this version or later to remediate the vulnerability. Detailed release information is available in the OneUptime Release 10.0.21.

Workarounds

• Restrict access to the Synthetic Monitor feature to only trusted administrative users
• Implement network isolation for oneuptime-probe containers to limit potential lateral movement
• Deploy container runtime security to monitor and block suspicious process execution
• Apply strict firewall rules to limit outbound connectivity from probe infrastructure

# Example: Restrict Synthetic Monitor access by limiting project user permissions
# Review and remove untrusted users from projects with Synthetic Monitor capabilities
# Implement network policies if running in Kubernetes

# Example Kubernetes NetworkPolicy to restrict probe egress
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-probe-egress
spec:
  podSelector:
    matchLabels:
      app: oneuptime-probe
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8  # Internal network only
EOF