9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32306

CVE-2026-32306: OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32306

CVE-2026-32306:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oneuptime	npm	< 10.0.23	10.0.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of this vulnerability began with the detailed description provided, which pointed to a SQL injection vulnerability in the telemetry aggregation API of OneUptime. The root cause is the lack of input validation for user-controlled parameters that are used to construct a SQL query.

To pinpoint the exact vulnerable functions, I followed these steps:

I identified the patched version from the vulnerability details (10.0.23) and the repository name (OneUptime/oneuptime).
Using the get_repo_tags tool, I found the commit SHAs for the patched version (bbd6bdac1229598d880ec7b02219ae72af221206) and the last vulnerable version (fed52fecd9cc384bc8cbc03d9765e5b610201eca).
I then used the compare_two_commits tool to list all the commits between these two versions. This revealed the commit 02e2a247c3320ceb5e96dbbad5eb4d15d0d73d13 with the message 'fix(analytics): validate aggregation types and column names in aggregateBy method', which is clearly the security patch.
I fetched the details of this commit using get_commit_infos. The patch showed that validation logic was added to the AnalyticsDatabaseService.ts file.
Based on the commit message and the context of the changes, the vulnerable method was identified as aggregateBy within the AnalyticsDatabaseService class. This method was vulnerable because it did not validate its inputs before they were used in a query.
The vulnerability description also explicitly mentioned the Statement.append method as the function performing raw string concatenation, which is the mechanism that allows the injection to occur. The provided code snippet for this method serves as direct evidence.

Therefore, two primary functions are identified as vulnerable: AnalyticsDatabaseService.aggregateBy for its failure to validate input, and Statement.append for its unsafe handling of SQL query construction. An exploit would involve a call to AnalyticsDatabaseService.aggregateBy, which would in turn call Statement.append with malicious data.

Vulnerable functions

AnalyticsDatabaseService.aggregateBy

Common/Server/Services/AnalyticsDatabaseService.ts

The `aggregateBy` method in `AnalyticsDatabaseService` is vulnerable to SQL injection. It receives user-controlled data in the `aggregateBy` object, including `aggregationType`, `aggregateColumnName`, and `aggregationTimestampColumnName`. Prior to the patch, this method failed to validate or sanitize these inputs before they were used to construct a ClickHouse SQL query. An attacker could provide a malicious SQL payload in these parameters, which would be directly concatenated into the query, leading to arbitrary SQL execution. The patch mitigates this by adding strict validation against an allowlist for `aggregationType` and ensuring that the column names exist in the database model.

Statement.append

Common/Server/Utils/AnalyticsDatabase/Statement.ts

The `append` method in the `Statement` class is a core part of the vulnerability. It performs raw string concatenation to build the SQL query. Although documented to be used with 'trusted SQL', it was called with untrusted user input that originated from the `aggregateBy` parameters. This method's behavior is what allows the SQL injection payload to be inserted directly into the query string that gets executed by the database.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.