Uptime Kuma Race Condition Leads to Admin Account Creation

Executive Summary

CVE-2026-119552 is a race condition vulnerability in Uptime Kuma versions up to 2.5.8. It occurs during the first-run setup process where the system checks if the user table is empty before creating an admin account. Attackers exploit this by sending concurrent setup requests during the bcrypt hashing delay, bypassing the check and creating multiple admin accounts. This allows unauthorized access to modify monitors, API keys, and disable authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if Uptime Kuma is running version 2.5.8 or earlier. Inspect network traffic for concurrent setup requests during the first-run process. Look for unexpected administrator accounts or disabled authentication settings.

Useful 0 Not Useful 0

Impact Analysis

If exploited, attackers gain full admin access to your Uptime Kuma instance. They can modify or delete monitors, steal API keys, disable authentication, and potentially take control of your monitoring setup. This could lead to undetected outages or data breaches if sensitive services are being monitored.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Uptime Kuma to a version beyond 2.5.8 immediately. If upgrading is not possible, restrict access to the first-run setup endpoint and avoid exposing it on shared networks. Review user accounts for unauthorized administrators and re-enable authentication if disabled.

Useful 0 Not Useful 0