CVE-2026-39401: Privilege Escalation via update_event Job Output in Cronicle
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cronicleto a version that resolves this vulnerability.Fixed in 0.9.111
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39401?
CVE-2026-39401 is classified as a privilege escalation vulnerability.
How do I fix CVE-2026-39401?
To fix CVE-2026-39401, upgrade Cronicle to version 0.9.111 or later.
What software is affected by CVE-2026-39401?
CVE-2026-39401 affects Cronicle versions prior to 0.9.111.
What type of vulnerability is CVE-2026-39401?
CVE-2026-39401 is specifically a privilege escalation vulnerability.
Can CVE-2026-39401 be exploited remotely?
Yes, CVE-2026-39401 can potentially be exploited by attackers with the ability to run jobs within Cronicle.