Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Affects Cronicle before 0.9.124 when a non-admin user holds run_events privilege and at least one event uses a plugin. The fix is in 0.9.124.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 0.9.124
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Cronicle instance prior to 0.9.124 Attacker holds a non-admin user account with run_events privilege At least one event exists that uses a plugin
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cronicle, a multi-server task scheduler and runner, is vulnerable to remote attackers who hold a low-privilege account with run, create, or edit event rights, letting them inject undeclared keys into event parameters that become environment variables for plugin processes. Because these keys can override security-sensitive variables, an attacker could escalate privileges, execute arbitrary code, access data, or disrupt the service, depending on the plugin and runtime.
Read the original description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity9/10CVSS 9.0
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Cronicle instance prior to 0.9.124 Attacker holds a non-admin user account with run_events privilege At least one event exists that uses a pluginUpgrade to a fixed version: 0.9.124.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- jhuckaby Cronicle
fixed in 0.9.124
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-85076
Is CVE-2026-85076 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A non-admin user can override admin-controlled execution environment settings of plugin jobs, such as PATH, LD_PRELOAD, NODE_OPTIONS and BASH_ENV. This can enable privilege escalation and arbitrary code execution.Source: github.com
Which versions are affected by CVE-2026-85076?
Cronicle: before 0.9.124.Source: cve.now feed data
Am I affected, and how do I check?
Cronicle versions before 0.9.124 are affected, in setups with at least one non-admin user account that has run_events privilege and at least one event that uses a plugin (Shell Script, HTTP Request, Test Plugin, or custom). To check, look at the installed Cronicle version and at which accounts have run_events privilege and which events use plugins.Source: github.com
How do I fix CVE-2026-85076?
Upgrade Cronicle to version 0.9.124 or later.Source: github.com