Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85076— Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

Quick assessment

Affected
jhuckaby Cronicle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cronicle 是一款基于 Web 前端界面的多服务器任务调度器与执行器。在 0.9.124 版本之前，拥有 、 或 权限的非管理员认证用户，可通过 、 或 接口，在事件参数中提交未声明的键（keys）。由于 和 在验证参数对象时未限制其键名，而 会将这些键转换为大写，并将其作为环境变量注入到子进程环境中（位于管理员定义的插件变量之后），因此，若某个键与敏感的环境变量名称发生冲突，便可能覆盖插件的执行上下文，进而导致权限提升、任意代码执行、数据泄露或服务中断等后果，具体影响取决于所使用的插件及运行环境。该问题已在

CVSS 9.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85076

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Source: CVE Program / CVE List V5
Vulnerability Description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jhuckaby Cronicle < 0.9.124 -

II. Public POCs for CVE-2026-85076

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85076

请登录查看更多情报信息。

Other References for CVE-2026-85076 (3)

IV. Related Vulnerabilities

Same product: Cronicle
Same vendor: jhuckaby
Same weakness: CWE-863