CVE-2026-119552

CVSS 6.3 (medium) · published 2026-10-30

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.

Weakness: CWE-367

Source: NVD CVE-2026-119552

References

• https://abraxaslabs.tech/research/uptime-kuma-setup-toctou
• https://github.com/louislam/uptime-kuma
• https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722
• https://www.vulncheck.com/advisories/uptime-kuma-through-2.5.8-race-condition-admin-creation-via-setup-handler

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.