OneUptime versions 14.0.2 through 14.0.68 contain an incorrect authorization flaw in the Kubernetes AI Actions module that allows authenticated project members to perform actions against clusters outside their authorized scope. The flaw permits exploitation of project‑wide permission checks, enabling an attacker to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on resources they should not control. This weakness corresponds to CWE‑863, describing incorrect authorization.

System owners using OneUptime on releases 14.0.2 up to but excluding 14.0.69 are affected. The vulnerability applies to the OneUptime platform as a whole, regardless of hosting environment, as it lies in the core API responsible for cluster management. Users must verify their installation version and upgrade if they are running any of these releases.

The base CVSS score of 5.3 indicates medium severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated project members, limiting the threat to insiders or compromised accounts. While the impact includes potential disruption of cluster operations and unauthorized command execution, the need for prior authentication reduces the likelihood of widespread exploitation. Nonetheless, the ability to manipulate Kubernetes resources warrants timely remediation.