EUVD-2026-111408Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with scoped create/run_events API key
-
DeliveryPOST crafted create_event containing top-level uid:0
-
ExploitValidator allow-list passes unknown uid verbatim
-
Executionroot daemon setuids spawned job to uid 0
-
ImpactArbitrary command execution as root on Cronicle host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated identity - a non-administrator Cronicle user account or a scoped API key - holding both the create_events and run_events privileges, used against the /api/app/create_event or /api/app/update_event endpoints to inject top-level uid (and gid) fields. Escalation to root specifically requires the Cronicle daemon to be running as root, which the advisory states is the default per docs/Setup.md; on a non-root daemon the impact is bounded by the daemon's own privileges. The injected identity only survives when the target plugin does not itself define a uid - true of the shipped default shellplug (Shell Script) and urlplug (HTTP Request) plugins. Limiting factors: the attacker must already possess a valid account or API key with those two specific privileges, and the full root-compromise outcome depends on the common-but-not-universal root-daemon deployment mode. |
| Impact | This is a genuine, high-priority privilege-escalation issue rather than a high-CVSS-but-low-real-risk one, though several signals are missing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, with full confidentiality/integrity/availability impact - consistent with the mechanism described: a non-admin user or scoped API key with only create_events/run_events can inject a top-level uid/gid and have the root daemon launch a job as any user, including root. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with no CISA KEV entry and no EPSS score being supplied in the input - so there is no evidence of active or automatable mass exploitation yet. However, the GHSA advisory includes a detailed, tested live reproduction and references a scripted exploit (exploit.sh), so a working proof path is documented. No EPSS value is provided, so exploitation probability cannot be quantified. The real-world severity is gated by prerequisites (an authenticated account/API key with the two specific event privileges, and the typical root-daemon deployment), but on that default configuration the outcome is low-priv-to-root code execution on the host, which warrants prompt patching. |
| Exploit ScenarioDerived | An attacker holding a non-admin Cronicle account or a scoped API key with only create_events and run_events privileges sends a create_event (or update_event) request to the API containing an extra top-level "uid":0 field alongside an ordinary Shell Script (shellplug) job. The validator silently stores the injected uid, and when the event is run the root daemon setuids the child process to uid 0, executing the attacker's script as root. A public PoC reference exists in the GHSA advisory (a documented live reproduction and exploit.sh script); it is not verified in the input as packaged working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Privilege escalation in Cronicle through 0.9.120 lets an authenticated non-administrator user, or a scoped API key, that holds only create_events and run_events privileges inject top-level uid and gid fields into an event, which the root daemon then honours when launching the child process - so the low-privileged principal can run jobs as any local account, including root. Root compromise depends on the deployment mode: the advisory states a root-running daemon is the default per docs/Setup.md, while on a non-root daemon the impact is bounded by the daemon's own privileges; the injected identity also only survives with plugins that do not define their own uid, which is true of the shipped shellplug and urlplug defaults. This is a distinct sibling of the previously patched job-output injection tracked as CVE-2026-39401. Vendor-released patch: 0.9.121; no CISA KEV listing and no confirmed weaponized exploit, though the advisory publishes a working reproduction script; the assessed priority is to remediate this week.
RemediationAI
Upgrade to Cronicle 0.9.121, which strips cwd, uid, gid and env at both the API validation layer (lib/api.js) and job launch (lib/job.js); the release is at https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.121 and the fix commit is https://github.com/jhuckaby/Cronicle/commit/f3d3550d0f3fe89bab52d3788f0db1dd10860df2, with details in advisory GHSA-9xpg-9w3g-mpwj. Where upgrading cannot happen immediately, run the Cronicle daemon as a dedicated non-root account rather than root - this does not fix the injection but bounds any escalation to the daemon's own privileges, at the cost of losing the ability to launch jobs as other system users; additionally audit and restrict who holds the create_events and run_events privileges and revoke scoped API keys carrying them, noting that this only removes the non-admin foothold and does not help if legitimate users of those privileges are the threat. Because the affected code path is exercised through the event create/update API, no network-level control short of blocking /api/app/ endpoints entirely will prevent it, and that would break normal scheduling functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing-authorization / mass-assignment problem (CWE-269 improper privilege management, with the advisory also classifying it CWE-862 and CWE-915) in the Node.js Cronicle scheduler. In lib/api.js, requireValidEventData delegates to validateOptionalParams, which acts as a partial allow-list: it only validates keys present in its rules object and silently passes unknown keys through, so uid and gid supplied in a POST to /api/app/create_event or /api/app/update_event are persisted verbatim on the stored event. In lib/job.js, launchJob copies the entire event object into the job, and the conditional if (plugin.uid) job.uid = plugin.uid; overwrites that value only when the plugin itself defines a uid; the bundled default plugins (shellplug for Shell Script, urlplug for HTTP Request) define none, so the event-controlled identity survives to child_opts.uid = job.uid || process.getuid(), is resolved via getpwnam, and is applied by the root daemon through cp.spawn's setuid option. Setting a run-as user is otherwise an administrator-only control (the Plugin 'Run as User' option is requireAdmin gated). The fix commit f3d3550d0f3fe89bab52d3788f0db1dd10860df2 hardens both layers: lib/api.js deletes event.cwd, event.uid, event.gid and event.env so they cannot be persisted, and lib/job.js deletes job.cwd, job.uid, job.gid and job.env so event/API-level overrides are never honoured, with regression tests asserting the fields are absent from the stored event and the launched job. That is broader than the earlier job-output uid/gid gate at lib/job.js:716-718 shipped for CVE-2026-39401, which did not cover the API-side event injection path.
Know when Cronicle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network API reachable (AV:N) with no special trigger conditions (AC:L); requires a low-privileged authenticated account/API key (PR:L), no user interaction (UI:N); run-as-root yields full C/I/A on the host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with create_events and run_events privileges can inject top-level uid and gid fields through /api/app/create_event or /api/app/update_event. In lib/api.js, requireValidEventData uses validateOptionalParams as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In lib/job.js, launchJob copies the whole event into the job, and a plugin uid overrides the event uid only when the plugin defines one. The default shellplug and urlplug plugins do not define a uid, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output uid/gid injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Technical POC Analysis
CWE-269 (Improper Privilege Management), tagged also as CWE-862 and CWE-915 by the vendor.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Cronicle versions through 0.9.120 contain a high-severity privilege escalation flaw that allows authenticated users with limited event permissions to run jobs as any local account, including root, in default deployments. This puts the entire host and its data at risk, requiring immediate remediation to prevent unauthorized privilege escalation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Stored cross-site scripting in Cronicle (all releases prior to 0.9.119) lets a user-controlled account field - the full_
Stored cross-site scripting (XSS) in Cronicle prior to 0.9.111 allows authenticated users with create_events and run_eve
Cronicle prior to 0.9.111 allows low-privilege authenticated users to modify arbitrary event properties via an authoriza
Exploit-DB