CVE-2026-58255

Received Received - Intake

Privilege Escalation in Cronicle via Event Injection

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-58255

Affected Vendors & Products

Vendor	Product	Version / Range
jhuckaby	Cronicle	< 0.9.121

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

Cronicle before 0.9.121 allows non-admin users with specific privileges to inject uid and gid fields into events via API endpoints. The application's validation function silently accepts unknown keys, storing them in the event data. These fields can override user identity during job execution, allowing privilege escalation.

Detection Guidance

Check Cronicle version with 'curl -s http://localhost:3055/api/app/version' or inspect server logs for unauthorized event creation via '/api/app/create_event' or '/api/app/update_event' endpoints. Look for events with uid/gid fields set by non-admin users.

Impact Analysis

If exploited, this flaw lets low-privileged users run jobs as arbitrary users, including root on systems where Cronicle runs as root. This could lead to unauthorized system access, data manipulation, or privilege escalation, depending on the jobs executed.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or systems. GDPR and HIPAA mandate strict access controls and audit logging; privilege escalation risks undermine these controls, potentially leading to data breaches or unauthorized modifications.

Mitigation Strategies

Upgrade Cronicle to version 0.9.121 or later. Temporarily restrict non-admin user permissions to prevent event creation/update. Monitor for suspicious event submissions and disable root-daemon mode if possible.

Hi! I’m here to help you understand CVE-2026-58255. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70