Incorrect Authorization in OneUptime Allows Unauthorized Cluster Access

Executive Summary

This vulnerability in OneUptime 14.0.2 before 14.0.69 allows authenticated project members to perform actions on Kubernetes clusters outside their assigned scope due to incorrect authorization checks. Attackers can exploit features like AI access testing, agent resets, kubectl plan approvals, and incident AI conversations to gain unauthorized access or disrupt services.

Useful 0 Not Useful 0

Detection Guidance

Check OneUptime logs for repeated unauthorized AI access tests or agent resets. Monitor Kubernetes cluster resource usage for spikes from AI test jobs. Review API calls to /kubernetes-cluster/ai-access/test for excessive requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could exploit this to run unauthorized commands on clusters, disconnect agents, approve changes without proper permissions, or consume cluster resources leading to denial-of-service conditions. It may also allow privilege escalation or unauthorized data access depending on cluster configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to Kubernetes clusters, potentially exposing sensitive data or enabling unauthorized actions. GDPR requires strict access controls and data protection, while HIPAA mandates secure handling of health information. The flaw allows authenticated users to perform actions outside their scope, risking data breaches or unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OneUptime to version 14.0.69 or later. Restrict edit permissions on Kubernetes clusters to only necessary users. Disable AI investigation features until upgraded. Review and tighten project-wide permissions to enforce cluster-specific checks.

Useful 0 Not Useful 0