CVE-2026-119552

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, the...

CVE-2026-119552 Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, the...

CVE-2026-119552 Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, the...

CVE-2026-119552

Uptime Kuma versions through 2.5.8 are vulnerable to a race condition (CWE-367) within the Socket.IO first-run setup handler . Unauthenticated attackers can exploit a Time-of-check Time-of-use (TOCTOU) flaw by sending concurrent setup requests during the bcrypt hashing window . This allows them t...

EUVD-2026-113817

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, the...

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

PT-2026-133490

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, the...

uptime-kuma-setup-toctou

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · uptime-kuma-setup-toctou Write-up: https://abraxaslabs.tech/research/uptime-kuma-setup-toctou uptime-kuma-setup-toctou Uptime Kuma 2.5.5 - Louis Lam First-run Socket.IO setup COUNTs users, bcrypts at cost 10, then...

CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Local File Inclusion LFI via Improper URL Handling in Real-Browser monitor Summary An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This vulnerability is triggered via the...

CVE-2026-52724

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

EUVD-2026-78773

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724

Kuma is an Envoy-based service mesh. In Universal mode , when kuma-dp connects to an HTTPS control plane without a CA certificate (--ca-cert-file unset and KUMA_CONTROL_PLANE_CA_CERT unset), TLS peer verification is disabled . An on-path attacker can intercept the dataplane authentication token, ...