GHSA-P5G2-JM85-8G35 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Summary The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append method documented as "trusted SQL". There is no allowlist, no parameterized...

EUVD-2026-11719

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters...

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Summary The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append method documented as "trusted SQL". There is no allowlist, no parameterized...

CVE-2026-32306

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

OneUptime SQL injection vulnerability

OneUptime is a comprehensive solution developed by OneUptime OpenSource. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.23 contained a SQL injection vulnerability. This vulnerability stemmed from the telemetry aggregation API directly inserting...

CVE-2026-32306: Improper Neutralization of Special Elements used in an SQL Command

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

CVE-2026-32306

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

CVE-2026-32306

CVE-2026-32306 affects OneUptime prior to 10.0.23. The telemetry aggregation API interpolates user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName into ClickHouse queries via .append() with no allowlist, parameterized binding, or input validation. An authentica...

CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .appe...

PT-2026-25085

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.23 Description OneUptime’s telemetry aggregation API is susceptible to SQL injection due to the direct interpolation of user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName...

acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0), airflow-clickhouse-plugin (>=0.11.0, <=1.0.0.post0) +1 more potentially affected by CVE-2025-69219 via apache-airflow-providers-http (4.10.1)

apache-airflow-providers-http PYPI version 4.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.11.0, =2.6.0, =2.6.3 Source cves: CVE-2025-69219 Source...

airflow-clickhouse-plugin (1.4.0), apache-airflow (>=2.10.0, <=2.10.5) +16 more potentially affected by CVE-2025-69219 via apache-airflow-providers-http (5.5.0)

apache-airflow-providers-http PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - airflow-clickhouse-plugin 1.4.0 - apache-airflow =2.10.0, =2.10.3, =1.7.15, =1.8.0rc2, =4.3.0, =1.4.10...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +45 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)

dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =1.8.0, =1.8.2 and more Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...

BIT-SUPERSET-2026-23969 Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...

SQL Injection

Apache Superset is vulnerable to SQL Injection. The vulnerability is due to an incomplete default list of restricted SQL functions for the ClickHouse engine, where attackers can execute potentially sensitive SQL functions within SQL Lab and charts...

cloud.testload:jmeter-clickhouse-listener (2.00), com.bobpaulin.jmeter:aws-include-controller-plugin (0.0.1) +99 more potentially affected by CVE-2026-28208 via com.github.junrar:junrar (2.0.0)

com.github.junrar:junrar MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.junrar:junrar and may be impacted: - cloud.testload:jmeter-clickhouse-listener 2.00 - com.bobpaulin.jmeter:aws-include-controller-plugin 0.0.1 -...

CVE-2026-23969

Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...

GHSA-48M2-V2R8-H23M Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...