{"id":"CVE-2026-58255","kind":"vulnerability","aliases":["CVE-2026-58255"],"related":[],"title":"Cronicle: low-privileged users can run jobs as root","description":"Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.","summary":"Cronicle's event API accepts unvalidated top-level uid and gid fields, which are stored and used to launch jobs. A non-admin user with create and run privileges can therefore execute jobs as any user, including root, on a root-run installation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cronicle","package","root-daemon","self-hosted","task-scheduler"],"not_affected_if":["admin-only-events","non-root-daemon","version-0.9.121-or-later"],"how_to_check":"- Check the installed Cronicle version with `cat package.json | grep '\"version\"'` in the Cronicle install directory; versions below `0.9.121` are affected.\n- Check whether the Cronicle daemon runs as root, for example with `ps -o user= -C node` or by reviewing the service unit file.\n- Review which users or API keys hold `create_events` and `run_events` privileges.","fix":"- Upgrade Cronicle to `0.9.121` or later.\n- Until upgraded, restrict `create_events` and `run_events` privileges to trusted administrators and rotate any scoped API keys that hold them.","status":"open","published_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:15+00:00","updated_at":"2026-10-27T23:31:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T23:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cronicle to `0.9.121` or later.\n- Until upgraded, restrict `create_events` and `run_events` privileges to trusted administrators and rotate any scoped API keys that hold them.","reach":"network","title":"Cronicle: low-privileged users can run jobs as root","impact":"high","summary":"Cronicle's event API accepts unvalidated top-level uid and gid fields, which are stored and used to launch jobs. A non-admin user with create and run privileges can therefore execute jobs as any user, including root, on a root-run installation.","category":"package","nicknames":[],"who_cares":["cronicle","self-hosted","root-daemon","task-scheduler"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs jobs as root on the scheduler host","analyst_note":"","how_to_check":"- Check the installed Cronicle version with `cat package.json | grep '\"version\"'` in the Cronicle install directory; versions below `0.9.121` are affected.\n- Check whether the Cronicle daemon runs as root, for example with `ps -o user= -C node` or by reviewing the service unit file.\n- Review which users or API keys hold `create_events` and `run_events` privileges.","needs_analyst":false,"not_affected_if":["version-0.9.121-or-later","admin-only-events","non-root-daemon"],"who_is_affected":"Installations of Cronicle before `0.9.121` that run the daemon as root are the main concern, because the injected identity lets jobs run as root. Exposure requires that some non-administrator user or scoped API key holds both `create_events` and `run_events`. Installations running the daemon as an unprivileged user, or where only administrators can create and run events, have a much smaller exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":3591,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,242C '-39401':243C '-58255':13A,16A '/api/app/create_event':121C '/api/app/update_event':123C '0.9.121':94C,250C 'accept':32B 'address':239C 'admin':52B 'administr':98C,216C 'administrator-on':215C 'allow':133C 'allow-list':132C 'api':31B,102C,225C 'api-sid':224C 'arbitrari':208C 'base':87C 'bypass':212C 'child':189C 'child-process':188C 'control':184C,222C 'copi':148C 'creat':55B,105C 'cronicl':1A,17B,28B,74C 'cve':11A,14A,241C 'daemon':21B,196C 'default':170C 'defin':167C,177C 'distinct':230C 'end':90C 'event':30B,106C,109C,151C,161C,183C,227C 'event-control':182C 'execut':61B 'field':40B,119C,143C 'fix':247C 'front':89C 'front-end':88C 'gid':39B,118C,237C 'host':24B 'ident':185C 'includ':66B,210C 'inject':112C,142C,228C,238C 'instal':73B,197C 'issu':245C 'job':8A,48B,62B,154C,206C,234C 'job-output':233C 'key':103C,139C 'launch':47B,191C 'launchjob':147C 'let':199C 'level':36B,115C 'lib/api.js':125C 'lib/job.js':146C 'list':134C 'low':3A,202C 'low-privileg':2A,201C 'multi':78C 'multi-serv':77C 'non':51B,97C 'non-admin':50B 'non-administr':96C 'one':168C 'otherwis':214C 'output':235C 'overrid':159C 'packag':18B 'partial':131C 'pass':137C 'plugin':157C,166C,174C 'prior':92C 'privileg':4A,58B,110C,203C 'process':190C 'requirevalideventdata':126C 'root':10A,20B,67B,71B,195C,211C 'root-daemon':19B,194C 'root-run':70B 'run':7A,57B,72B,108C,205C,219C 'run-as-us':218C 'runner':83C 'schedul':27B,81C 'scope':101C 'self':23B 'self-host':22B 'server':79C 'shellplug':171C 'side':226C 'silent':136C 'store':43B,140C 'surviv':186C 'task':26B,80C 'task-schedul':25B 'therefor':60B 'top':35B,114C 'top-level':34B,113C 'ui':91C 'uid':37B,116C,158C,162C,179C,236C 'unknown':138C 'unvalid':33B 'urlplug':173C 'use':45B,127C 'user':5A,53B,65B,99C,204C,209C,221C 'validateoptionalparam':128C 'verbatim':144C 'version':249C 'web':86C 'whole':150C","nicknames":[],"mitigations":[],"who_affected":"Installations of Cronicle before `0.9.121` that run the daemon as root are the main concern, because the injected identity lets jobs run as root. Exposure requires that some non-administrator user or scoped API key holds both `create_events` and `run_events`. Installations running the daemon as an unprivileged user, or where only administrators can create and run events, have a much smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58255","severity":null,"published_at":"2026-10-27T23:17:05+00:00","modified_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}