OneUptime: password reset tokens written to INFO logs allow account takeover from log access

Impact

OneUptime's password reset flow logs the full reset URL, including the plaintext token, at INFO level - which is on by default in production. Anyone who can read the application's logs can take over any account, including administrative ones. For an operator this inverts the usual trust direction: log aggregation, Docker logs and Kubernetes pod logs are typically readable by a much wider group (SRE, on-call, anyone with kubectl logs on the namespace, anyone querying the log backend) than the monitoring platform's own admin role. Taking over the monitoring and status-page system means altering alerting and on-call routing for the fleet, so the cluster can be made to look healthy while it is not.

Who can reach it

Any principal able to read OneUptime's application logs - log aggregation search, docker logs, kubectl logs on the pod - combined with triggering a password reset for the target account. No OneUptime credentials needed.

What to do

Upgrade OneUptime to 10.0.24 or later and restart/redeploy the containers; this is an application-level update, no node drain involved. Because tokens already sitting in retained logs stay valid until they expire, also purge or restrict access to historical logs containing reset URLs, force a password reset for privileged accounts, and tighten who can read the log backend.

References

Related entries

• Terragrunt: malicious module manifest deletes files outside the module cache during cleanupCVE-2026-45099 · Terragrunt (module cache cleanup, .terragrunt-module-manifest path handling)Medium
• Inspektor Gadget: crafted ld.so.cache in a container stalls the container-start hook cluster-wideCVE-2026-53941 · Inspektor Gadget (uprobe ld.so.cache parser, pkg/uprobetracer)Medium
• Renovate: minimumReleaseAge is not applied to digest updates, so fresh dependency digests reach CI earlyCVE-2026-88884 · Renovate (minimumReleaseAge enforcement for digest updates)Medium
• Schneider Electric StruxureWare Data Center Expert before 7.4.0: Passwords held in cleartext in RAM on the DCIMCVE-2017-8371 · Schneider Electric StruxureWare Data Center Expert before 7.4.0Medium
• RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)CVE-2020-12355 · RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)Medium
• Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMeCVE-2020-13799 · Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMe - multi-vendor…Medium