---
id: "CVE-2026-119552"
kind: "vulnerability"
aliases: ["CVE-2026-119552"]
title: "Uptime Kuma: first-run setup race lets attackers create extra administrator accounts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "socket.io", "uptime-kuma"]
not_affected_if: ["managed-hosting", "setup-completed"]
published_at: "2026-10-30T12:16:42+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:32:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119552", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# Uptime Kuma: first-run setup race lets attackers create extra administrator accounts

Uptime Kuma through 2.5.8 has a race condition in its Socket.IO first-run setup handler. Unauthenticated attackers can send concurrent setup requests during the bcrypt hashing window, creating an extra administrator account and then changing monitors, API keys and the disableAuth setting.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Uptime Kuma version against the affected range (through `2.5.8`).
- Review the user table for unexpected administrator accounts.
- Check whether `disableAuth` is enabled in settings.

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119552

## From the sources

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_