{"id":"CVE-2026-119552","kind":"vulnerability","aliases":["CVE-2026-119552"],"related":[],"title":"Uptime Kuma: first-run setup race lets attackers create extra administrator accounts","description":"Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.","summary":"Uptime Kuma through 2.5.8 has a race condition in its Socket.IO first-run setup handler. Unauthenticated attackers can send concurrent setup requests during the bcrypt hashing window, creating an extra administrator account and then changing monitors, API keys and the disableAuth setting.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","socket.io","uptime-kuma"],"not_affected_if":["managed-hosting","setup-completed"],"how_to_check":"- Check the installed Uptime Kuma version against the affected range (through `2.5.8`).\n- Review the user table for unexpected administrator accounts.\n- Check whether `disableAuth` is enabled in settings.","fix":null,"status":"open","published_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:42+00:00","updated_at":"2026-10-30T12:32:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Uptime Kuma: first-run setup race lets attackers create extra administrator accounts","impact":"high","summary":"Uptime Kuma through 2.5.8 has a race condition in its Socket.IO first-run setup handler. Unauthenticated attackers can send concurrent setup requests during the bcrypt hashing window, creating an extra administrator account and then changing monitors, API keys and the disableAuth setting.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["uptime-kuma","self-hosted","socket.io"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker gains administrator access and can change monitors and settings","analyst_note":"Confirm the fixed version and whether exposure is limited to instances not yet set up; check the NVD entry for the CVSS vector.","how_to_check":"- Check the installed Uptime Kuma version against the affected range (through `2.5.8`).\n- Review the user table for unexpected administrator accounts.\n- Check whether `disableAuth` is enabled in settings.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","setup-completed"],"who_is_affected":"Teams running a self-hosted Uptime Kuma instance through version 2.5.8 that is reachable by others before its first-run setup finishes. The flaw sits in the initial setup path, so instances already set up with an admin account are less exposed, but the sources do not state this explicitly. Teams using a managed or newer build can skip it once they confirm their version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4144,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119552':16A,19A '-2026':15A,18A '2.5.8':31B,74C 'account':13A,60B,96C 'addit':94C 'administr':12A,59B,95C 'allow':88C 'api':65B,118C 'attack':9A,45B,90C,97C 'bcrypt':53B,105C 'bypass':109C 'chang':63B 'check':114C 'concurr':48B,100C 'condit':35B,78C 'contain':75C 'creat':10A,56B,92C 'cve':14A,17A 'disableauth':69B,122C 'empti':111C 'enabl':121C 'extra':11A,58B 'first':4A,40B,83C 'first-run':3A,39B,82C 'handler':43B,86C 'hash':54B,106C 'host':23B 'key':66B,119C 'kuma':2A,27B,29B,72C 'let':8A 'modifi':116C 'monitor':64B,117C 'race':7A,34B,77C 'request':50B,102C 'run':5A,41B,84C 'runtim':20B 'self':22B 'self-host':21B 'send':47B,99C 'set':70B 'setup':6A,42B,49B,85C,101C 'socket.io':24B,38B,81C 'tabl':113C 'unauthent':44B,89C 'uptim':1A,26B,28B,71C 'uptime-kuma':25B 'user':112C 'window':55B,107C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Uptime Kuma instance through version 2.5.8 that is reachable by others before its first-run setup finishes. The flaw sits in the initial setup path, so instances already set up with an admin account are less exposed, but the sources do not state this explicitly. Teams using a managed or newer build can skip it once they confirm their version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119552","severity":null,"published_at":"2026-10-30T12:16:42+00:00","modified_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}