Live › vulnerability › CVE-2026-119552
Uptime Kuma through 2.5.8 has a race condition in its Socket.IO first-run setup handler. Unauthenticated attackers can send concurrent setup requests during the bcrypt hashing window, creating an extra administrator account and then changing monitors, API keys and the disableAuth setting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams running a self-hosted Uptime Kuma instance through version 2.5.8 that is reachable by others before its first-run setup finishes. The flaw sits in the initial setup path, so instances already set up with an admin account are less exposed, but the sources do not state this explicitly. Teams using a managed or newer build can skip it once they confirm their version.
No product ranges from the sources yet.
2.5.8).disableAuth is enabled in settings.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
This page as .md · .json · in your agent: get_signal("CVE-2026-119552")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.