CVE-2026-119552
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Risk Assessment
Attackers can gain administrator privileges, leading to full control over the monitoring system and the ability to disable authentication.
Recommendation
Update Uptime Kuma to a version later than 2.5.8 or apply the vendor patch. Until then, restrict network access to the setup interface.
Other vulnerabilities in Uptime Kuma
See all- CVE-2026-71285High
Uptime Kuma's Matomo analytics integration injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
- CVE-2023-36822Medium
Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.
- CVE-2023-36821High
Uptime Kuma, a monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Although the plugin installation feature is currently disabled in the web interface, the corresponding API endpoints are still available after login.
Original NVD description (English source)
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS