uptime-kuma

v2.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 4d Monitoring & Metrics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

docker monitor monitoring responsive self-hosted single-page-app

+5 more

socket-io uptime uptime-monitoring web websocket

Affected surfaces

auth rce_ssrf deps

ReleasePort's take

Moderate signal

editorial:auto 3d

The release patches a Remote Code Execution vulnerability in the Admin/Auth subsystem.

Why it matters: Patches critical RCE (severity 95) affecting admin authentication; upgrade immediately.

Summary

AI summary

Updates 💇‍♀️ Improvements, 🆕 New Features, and 🐞 Bug Fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Patches Remote Code Execution vulnerability from upstream dependency. Patches Remote Code Execution vulnerability from upstream dependency. Source: llm_adapter@2026-05-31 Confidence: high	—
Feature
Feature	Low	Adds EgoSMS SMS provider for Uganda notifications. Adds EgoSMS SMS provider for Uganda notifications. Source: llm_adapter@2026-05-31 Confidence: high	—
Feature	Low	Adds incidents to RSS feed. Adds incidents to RSS feed. Source: llm_adapter@2026-05-31 Confidence: high	—
Feature	Low	Adds VKTeams bot notification provider. Adds VKTeams bot notification provider. Source: llm_adapter@2026-05-31 Confidence: high	—
Feature	Low	Adds optional token field for gamedig monitors. Adds optional token field for gamedig monitors. Source: llm_adapter@2026-05-31 Confidence: high	—
Feature	Low	Adds bearer token support to WebSocket upgrade monitor. Adds bearer token support to WebSocket upgrade monitor. Source: llm_adapter@2026-05-31 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes handling of npm version 11.16.0. Fixes handling of npm version 11.16.0. Source: llm_adapter@2026-05-31 Confidence: high	—
Bugfix	Medium	Fixes NTLM monitor failure over plain HTTP with 400 Bad Request. Fixes NTLM monitor failure over plain HTTP with 400 Bad Request. Source: llm_adapter@2026-05-31 Confidence: high	—
Bugfix	Low	Updates link to API keys documentation. Updates link to API keys documentation. Source: llm_adapter@2026-05-31 Confidence: high	—
Bugfix	Low	Normalizes hidden log level lookup. Normalizes hidden log level lookup. Source: llm_adapter@2026-05-31 Confidence: high	—

Full changelog

🆕 New Features

#7434 feat(notification): add EgoSMS SMS provider for Uganda (Thanks @kristianinc @cursoragent)
#7420 feat: Add incidents to RSS (Thanks @dj-tuxis)
#7365 feat: Add VKTeams bot notification provider (Thanks @aleshasam)

💇‍♀️ Improvements

#7433 feat: add optional token field for gamedig monitors (Thanks @aminoacidity)
#7415 feat: Adding bearer token (Thanks @aminoacidity @nyeswant)
#7431 fix: Add bearer token support to WebSocket upgrade monitor (Thanks @aminoacidity @nyeswant)
#7373 fix: update link to documentation about API keys (Thanks @eleanordoesntcode)

🐞 Bug Fixes

~#7453 fix(docker-only): add Let's Encrypt Gen Y root certificates~ (Unfortunately, curl is working, but Node.js is not)
#7451 fix: handling npm 11.16.0
#7351 fix: NTLM monitor over plain HTTP fails with 400 Bad Request (Thanks @karzac)

⬆️ Security Fixes

(Admin/Auth only) Remote Code Execution, a vulnerability from an upstream dependency (Reveal later, ping me if I forgot to reveal)

🦎 Translation Contributions

#7366 #7353 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @Arden-Ahmad @bartoostveen @cyril59310 @dodog @Gringit @helakostain @ivanbratovic @Jumala9163 @Kf637 @master3395 @MrEddX @OnyxOracle @PolarniMeda @samsilveira @toniv90 @ttymayor @Virenbar @xuantan97)

Others

#7432 chore: Implement dev data directory handling for non-master branches
#7390 fix: normalize hidden log level lookup (Thanks @aqilaziz)

Security Fixes

Upstream dependency Remote Code Execution vulnerability affecting admin/auth features

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track uptime-kuma

Get notified when new releases ship.

About uptime-kuma

A fancy self-hosted monitoring tool

All releases →