Live › vulnerability › CVE-2026-58255
Go to dashboardCronicle's event API accepts unvalidated top-level uid and gid fields, which are stored and used to launch jobs. A non-admin user with create and run privileges can therefore execute jobs as any user, including root, on a root-run installation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Installations of Cronicle before 0.9.121 that run the daemon as root are the main concern, because the injected identity lets jobs run as root. Exposure requires that some non-administrator user or scoped API key holds both and . Installations running the daemon as an unprivileged user, or where only administrators can create and run events, have a much smaller exposure.
create_eventsrun_eventsNo product ranges from the sources yet.
cat package.json | grep '"version"' in the Cronicle install directory; versions below 0.9.121 are affected.ps -o user= -C node or by reviewing the service unit file.create_events and run_events privileges.0.9.121 or later.create_events and run_events privileges to trusted administrators and rotate any scoped API keys that hold them.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with create_events and run_events privileges can inject top-level uid and gid fields through /api/app/create_event or /api/app/update_event. In lib/api.js, requireValidEventData uses validateOptionalParams as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In lib/job.js, launchJob copies the whole event into the job, and a plugin uid overrides the event uid only when the plugin defines one. The default shellplug and urlplug plugins do not define a uid, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output uid/gid injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
This page as .md · .json · in your agent: get_signal("CVE-2026-58255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.