CVE-2026-58255: Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js, requireValidEventData uses validateOptionalParams as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In lib/job.js, launchJob copies the whole event into the job, and a plugin uid overrides the event uid only when the plugin defines one. The default shellplug and urlplug plugins do not define a uid, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output uid/gid injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cronicleto a version that resolves this vulnerability.Fixed in 0.9.121
Event History
Frequently Asked Questions
Which deployments are most exposed to privilege escalation?
The highest-risk deployments run the Cronicle daemon as root and allow non-administrator users or scoped API keys to create and run events. In that configuration, affected users can cause jobs to run as arbitrary accounts, including root.
What permissions does an attacker need?
An attacker needs a non-administrator Cronicle account or scoped API key with both create_events and run_events privileges. No administrator-level run-as-user permission is required.
Are standard plugins affected?
Yes. The default shellplug and urlplug plugins do not define their own uid, so an injected event uid can reach child-process launch.
How can I determine whether an instance is vulnerable?
Instances prior to version 0.9.121 are affected when eligible non-admin users or API keys can create and run events. Review whether the daemon runs as root and whether such principals have create_events and run_events privileges.
What should be done if upgrading is not immediately possible?
Remove or restrict create_events and run_events privileges for non-administrator users and scoped API keys, particularly on root-daemon installations. Limit access to the create_event and update_event API endpoints until version 0.9.121 can be deployed.