CVE-2026-85076: Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with runevents, createevents, or editevents privilege can supply undeclared keys in event params through apicreateevent, apiupdateevent, or apirunevent. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cronicleto a version that resolves this vulnerability.Fixed in 0.9.124
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated non-admin user must have at least one of the run_events, create_events, or edit_events privileges. Users without those privileges are not described as able to exploit the affected API paths.
Which deployments are affected?
Cronicle versions prior to 0.9.124 are affected. Exposure depends on whether non-admin users have the required event-related privileges and can submit event parameters through the create, update, or run event APIs.
What is the immediate remediation?
Upgrade Cronicle to version 0.9.124, which fixes the issue. Until upgrading, limit run_events, create_events, and edit_events privileges to trusted users to reduce exposure.
What makes the impact dependent on the environment?
Injected parameter keys are uppercased and applied to the child-process environment after administrator-defined plugin variables. The resulting impact depends on whether a supplied key collides with a security-sensitive environment variable used by the relevant plugin or runtime.