The vulnerability in OneUptime's Worker service exposes workflow execution endpoints without authentication. By guessing or obtaining a workflow identifier, an attacker can trigger workflow runs with arbitrary input data, which can include JavaScript code. This allows execution of arbitrary code on the server, manipulation of monitored data, and abuse of notification mechanisms, effectively granting the attacker full control over the affected system.

Affected systems are installations of the OneUptime monitoring platform using a Worker service version earlier than 10.0.42. The issue specifically impacts the ManualAPI endpoints GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId available to any unauthenticated client.

The CVSS score of 9.2 indicates critical severity, and although EPSS data is unavailable, the lack of authentication and the broad impact make exploitation highly likely for exposed instances. The vulnerability is not listed in CISA’s KEV catalog, but the capability for remote code execution combined with easy interaction via HTTP requests elevates the risk significantly. The attack vector is assumed to be network-based HTTP traffic to the exposed endpoints, requiring only knowledge of a valid workflow ID.