CVE-2026-32306: Hackerbay OneUptime SQLi Vulnerability

CVE-2026-32306 Overview

OneUptime is an open-source monitoring and observability platform used for managing online services. A critical SQL injection vulnerability exists in versions prior to 10.0.23 within the telemetry aggregation API. The vulnerability allows authenticated users to inject arbitrary SQL commands into ClickHouse database queries, potentially enabling full database compromise, cross-tenant data access, and remote code execution.

Critical Impact
Authenticated attackers can inject arbitrary SQL into ClickHouse queries, enabling full database read access (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions.

Affected Products

Hackerbay OneUptime versions prior to 10.0.23

Discovery Timeline

2026-03-13 - CVE CVE-2026-32306 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32306

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from the telemetry aggregation API's unsafe handling of user-controlled input parameters. The API accepts three parameters—aggregationType, aggregateColumnName, and aggregationTimestampColumnName—and directly interpolates them into ClickHouse SQL queries using the .append() method, which is documented as handling "trusted SQL" only.

The fundamental security flaw lies in the absence of proper input validation controls. There is no allowlist restricting valid parameter values, no parameterized query binding to safely handle user input, and no input sanitization whatsoever. This allows attackers to craft malicious parameter values containing SQL syntax that gets executed by the ClickHouse database engine.

The Changed scope indicator in the vulnerability assessment means that a successful exploit affects resources beyond the vulnerable component itself. In this case, an attacker exploiting this vulnerability can access data belonging to other tenants in the multi-tenant environment, effectively breaking tenant isolation boundaries.

Root Cause

The root cause is improper input validation and the direct use of untrusted user input in SQL query construction. The .append() method used for query building expects sanitized, trusted SQL but receives raw user-controlled values. Without parameterized queries or an allowlist of valid column names and aggregation types, any authenticated user can manipulate the query structure.

Attack Vector

An authenticated attacker can exploit this vulnerability by sending specially crafted requests to the telemetry aggregation API endpoint. By manipulating the aggregationType, aggregateColumnName, or aggregationTimestampColumnName parameters, the attacker can inject arbitrary SQL commands into the backend ClickHouse query.

Successful exploitation enables several attack scenarios: reading sensitive telemetry data from all tenants in the database, modifying or deleting data across the platform, and potentially achieving remote code execution through ClickHouse table functions such as url(), file(), or s3() which can interact with external systems.

The attack requires network access and valid authentication credentials, though only low privileges are necessary to execute the exploit.

Detection Methods for CVE-2026-32306

Indicators of Compromise

Unusual or malformed values in aggregationType, aggregateColumnName, or aggregationTimestampColumnName API parameters containing SQL syntax characters such as single quotes, semicolons, or comment markers
ClickHouse query logs showing unexpected table functions like url(), file(), or s3() being executed
Access logs indicating requests to the telemetry aggregation API with abnormally long or encoded parameter values
Cross-tenant data access patterns or queries returning data outside normal user boundaries

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in API requests targeting the telemetry aggregation endpoints
Monitor ClickHouse audit logs for queries containing suspicious patterns, union-based injections, or unauthorized table function calls
Deploy runtime application security testing (RAST) to identify SQL injection attempts at the application layer
Set up alerts for authentication anomalies followed by unusual API access patterns

Monitoring Recommendations

Enable detailed logging on the telemetry aggregation API endpoints to capture full request parameters
Configure ClickHouse to log all queries with execution times to identify injection-based reconnaissance
Implement behavioral analytics to detect authenticated users accessing telemetry data outside their tenant scope
Regularly review access logs for patterns consistent with SQL injection probing techniques

How to Mitigate CVE-2026-32306

Immediate Actions Required

Upgrade OneUptime to version 10.0.23 or later immediately to patch this vulnerability
If immediate upgrade is not possible, restrict network access to the telemetry aggregation API endpoints to trusted sources only
Review ClickHouse query logs for evidence of prior exploitation attempts
Audit tenant data access patterns to identify any potential data breaches that may have occurred

Patch Information

The vulnerability has been fixed in OneUptime version 10.0.23. Organizations should upgrade to this version or later as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-p5g2-jm85-8g35.

Workarounds

Implement network-level restrictions to limit access to the telemetry aggregation API to trusted internal networks only
Deploy a Web Application Firewall with SQL injection detection rules in front of the OneUptime instance
Implement additional authentication controls or rate limiting on the affected API endpoints until patching is complete
Consider temporarily disabling the telemetry aggregation functionality if it is not critical to operations

bash

# Example: Restrict access to telemetry API via iptables
# Allow only trusted internal network to access OneUptime
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP