Executive Summary

CVE-2026-29779 is a sensitive data exposure vulnerability in the UptimeFlare project, a serverless uptime monitoring and status page solution. The issue arises because a private configuration object called workerConfig, which contains sensitive data such as credentials and monitor configurations, was mistakenly imported and bundled into client-side JavaScript code. This caused the entire workerConfig to be exposed to all visitors through their browsers.

The root cause was that client-side components like pages/incidents.tsx imported workerConfig directly, which should have been used only server-side. The vulnerability was fixed by refactoring the code to remove direct imports of workerConfig in client code, exposing only sanitized data via server-side rendering functions, and adding ESLint rules to prevent future improper imports.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'This vulnerability can lead to the full exposure of sensitive configuration data to any user visiting the UptimeFlare-powered site. Specifically, attackers or any users can access credentials and secrets such as API tokens, webhook URLs with embedded secrets (e.g., Telegram Bot API tokens, Discord webhook URLs), internal hostnames, IP addresses, TCP ports, HTTP authorization headers, and other confidential monitor configuration details.'}, {'type': 'paragraph', 'content': "Because these secrets are exposed in client-side JavaScript bundles, they can be easily extracted by inspecting the browser's developer tools, potentially allowing unauthorized access to notification channels and monitoring infrastructure."}, {'type': 'paragraph', 'content': 'The CVSS v3.1 base score of 7.5 reflects a high severity, with no privileges or user interaction required for exploitation, making it a serious risk.'}] [1, 2, 3]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the exposure of sensitive configuration data (workerConfig) in client-side JavaScript bundles of UptimeFlare. To detect it, you can inspect the client-side JavaScript served by your UptimeFlare deployment for the presence of sensitive data such as API tokens, webhook URLs, or internal hostnames.'}, {'type': 'paragraph', 'content': 'One practical approach is to fetch the client-side bundle files and search for keywords related to sensitive data. For example, you can use curl or wget to download the JavaScript bundle and grep to search for suspicious strings.'}, {'type': 'list_item', 'content': "curl -s https://your-uptimeflare-domain/_next/static/chunks/pages/incidents.js | grep -E 'token|webhook|Authorization|Bearer'"}, {'type': 'list_item', 'content': "Alternatively, inspect the browser's developer tools (Sources tab) to look for the presence of workerConfig or sensitive credentials in the loaded JavaScript files."}, {'type': 'paragraph', 'content': 'Since the vulnerability is caused by improper import of workerConfig in client-side code, reviewing your source code for imports of workerConfig in client components (e.g., pages/incidents.tsx, pages/index.tsx) can also help detect the issue.'}] [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade UptimeFlare to the patched version that includes commit 377a596 or later, which fixes the vulnerability by restricting workerConfig imports to server-side code only.

If immediate upgrading is not possible, you should temporarily remove all sensitive values from the workerConfig file to prevent exposure.

After upgrading or removing sensitive data, you must rotate all credentials that may have been exposed during the vulnerable period, including API tokens, webhook URLs, and other secrets.

• Upgrade UptimeFlare to the latest version including commit 377a596.
• Remove sensitive data from workerConfig if upgrade is delayed.
• Rotate all potentially exposed credentials immediately.

No workaround exists without code changes, so applying the patch and rotating secrets is critical.

Useful 0 Not Useful 0