The telemetry aggregation API in OneUptime accepts parameters aggregationType, aggregateColumnName, and aggregationTimestampColumnName and directly interpolates them into ClickHouse SQL queries via an .append() method labeled as "trusted SQL." Without an allowlist, parameterized binding, or input validation, an authenticated user can inject arbitrary SQL. This SQL injection (CWE‑89) permits reading all tenant telemetry data, modifying database contents, and potentially executing code through ClickHouse table functions.

All installations of OneUptime running a version earlier than 10.0.23 are vulnerable. The vulnerability was fixed in release 10.0.23, so any deployment whose version number is 10.0.22 or older, or that has not applied the patch, is at risk.

The vulnerability has a CVSS score of 10, signifying critical severity, and an EPSS score of less than 1%, indicating a low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the telemetry aggregation API but does not require elevated privileges beyond those granted to a regular monitoring user. Successful exploitation would compromise the confidentiality, integrity, and potentially availability of all tenant telemetry data, and could lead to remote code execution on the underlying system.