---
id: "CVE-2026-58255"
kind: "vulnerability"
aliases: ["CVE-2026-58255"]
title: "Cronicle: low-privileged users can run jobs as root"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cronicle", "package", "root-daemon", "self-hosted", "task-scheduler"]
not_affected_if: ["admin-only-events", "non-root-daemon", "version-0.9.121-or-later"]
published_at: "2026-10-27T23:17:05+00:00"
first_seen_at: "2026-10-27T23:29:44+00:00"
updated_at: "2026-10-27T23:31:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58255", "first_seen_at": "2026-10-27T23:29:44+00:00"}]
---

# Cronicle: low-privileged users can run jobs as root

Cronicle's event API accepts unvalidated top-level uid and gid fields, which are stored and used to launch jobs. A non-admin user with create and run privileges can therefore execute jobs as any user, including root, on a root-run installation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cronicle version with `cat package.json | grep '"version"'` in the Cronicle install directory; versions below `0.9.121` are affected.
- Check whether the Cronicle daemon runs as root, for example with `ps -o user= -C node` or by reviewing the service unit file.
- Review which users or API keys hold `create_events` and `run_events` privileges.

## Fix

- Upgrade Cronicle to `0.9.121` or later.
- Until upgraded, restrict `create_events` and `run_events` privileges to trusted administrators and rotate any scoped API keys that hold them.

## Timeline

- 2026-10-27T23:29:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58255

## From the sources

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_