CVE-2026-32230: Uptime.kuma Uptime Kuma

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

Affected products

• Uptime.kuma Uptime Kuma: from 2.0.0, before 2.2.0 (fixed in 2.2.0)

Published 2026-03-12. Last modified 2026-06-17.