CVE-2026-58255— Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Quick assessment

Affected

jhuckaby Cronicle

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cronicle 是一个基于 Web 前端界面的多服务器任务调度器与执行器。在 0.9.121 版本之前，非管理员用户或具有和权限的作用域 API 密钥，可通过或接口注入顶层的和字段。在中，函数使用作为部分白名单机制，该机制会静默允许未知字段通过，并将注入的字段原样存储。在中，函数将整个事件对象复制到任务中；仅当插件明确定义了时，插件的才会覆盖事件中的。由于默认的和插件均未定义，因此由事件控制的身份会延续到子进程启动过程中。在由 root 用户运行的守护进程部署环境中，这使得低

CVSS 8.8 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Source: CVE Program / CVE List V5

Vulnerability Description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jhuckaby	Cronicle	< 0.9.121	-

II. Public POCs for CVE-2026-58255

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-58255

请登录查看更多情报信息。

Other References for CVE-2026-58255 (3)

https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.121 x_refsource_MISC
https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-9xpg-9w3g-mpwj x_refsource_CONFIRM
https://github.com/jhuckaby/Cronicle/commit/f3d3550d0f3fe89bab52d3788f0db1dd10860df2 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-58255

IV. Related Vulnerabilities

Same product: Cronicle

Same vendor: jhuckaby

Same weakness: CWE-269