{"id":"CVE-2026-85076","kind":"vulnerability","aliases":["CVE-2026-85076"],"related":[],"title":"Cronicle: authenticated users can inject environment variables into job processes","description":"Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.","summary":"Cronicle is a multi-server task scheduler with a web UI. Before 0.9.124, a logged-in non-admin user with event create, edit or run rights can pass arbitrary keys in event parameters that become environment variables for job processes, which can override the plugin execution context.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cronicle","package","self-hosted","task-scheduler"],"not_affected_if":["admin-only-events","version-0.9.124-or-later"],"how_to_check":"- Check the installed Cronicle version: `0.9.124` or later is fixed; anything earlier is affected.\n- Review which accounts hold run_events, create_events or edit_events privileges.","fix":"- Cronicle: upgrade to `0.9.124`.","status":"open","published_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","triaged_at":"2026-11-05T21:41:12+00:00","updated_at":"2026-11-05T21:41:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T21:41:12Z","model":"claude-haiku-5-5","output":{"fix":"- Cronicle: upgrade to `0.9.124`.","reach":"network","title":"Cronicle: authenticated users can inject environment variables into job processes","impact":"high","summary":"Cronicle is a multi-server task scheduler with a web UI. Before 0.9.124, a logged-in non-admin user with event create, edit or run rights can pass arbitrary keys in event parameters that become environment variables for job processes, which can override the plugin execution context.","audience":"businesses","category":"package","nicknames":[],"who_cares":["cronicle","self-hosted","task-scheduler"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs in job processes, possibly escalating privileges or reading data","analyst_note":"","how_to_check":"- Check the installed Cronicle version: `0.9.124` or later is fixed; anything earlier is affected.\n- Review which accounts hold run_events, create_events or edit_events privileges.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.9.124-or-later","admin-only-events"],"who_is_affected":"Teams that run Cronicle for scheduled jobs and give non-admin users the ability to create, edit or run events. The flaw needs an authenticated account with one of those privileges; installations where only administrators can manage events are less exposed. Instances already on 0.9.124 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000702,"input_tokens":4410,"output_tokens":523,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85076':13A,16A '0.9.124':38B,95C,201C 'access':185C 'admin':45B,100C 'administr':154C 'administrator-defin':153C 'api':118C,121C,125C 'appli':145C 'arbitrari':56B,181C 'authent':2A,97C 'base':88C 'becom':62B 'caus':178C 'child':149C 'code':182C 'collid':161C 'context':74B,175C 'creat':49B,104C,119C 'cronicl':1A,17B,25B,75C 'cve':11A,14A 'data':184C 'defin':155C 'depend':189C 'disrupt':188C 'edit':50B,107C 'end':91C 'environ':6A,63B,151C,167C 'escal':180C 'event':48B,59B,103C,105C,108C,115C,120C,123C,127C 'execut':73B,174C,183C 'fix':198C 'front':90C 'front-end':89C 'host':21B 'inject':5A 'issu':196C 'job':9A,66B 'key':57B,113C,138C,143C,159C 'lib/api.js':128C 'lib/api/event.js':130C 'lib/job.js':140C 'log':41B 'logged-in':40B 'may':177C 'multi':29B,79C 'multi-serv':28B,78C 'non':44B,99C 'non-admin':43B,98C 'object':134C 'overrid':70B,171C 'packag':18B 'param':116C 'paramet':60B,133C 'pass':55B 'plugin':72B,156C,173C,192C 'prior':93C 'privileg':109C,179C 'process':10A,67B,150C 'restrict':136C 'right':53B 'run':52B,102C,126C 'runner':84C 'runtim':194C 'schedul':24B,32B,82C 'secur':165C 'security-sensit':164C 'self':20B 'self-host':19B 'sensit':166C 'server':30B,80C 'servic':187C 'suppli':111C 'task':23B,31B,81C 'task-schedul':22B 'therefor':170C 'ui':36B,92C 'undeclar':112C 'updat':122C 'uppercas':141C 'user':3A,46B 'valid':131C 'variabl':7A,64B,157C,168C 'version':200C 'web':35B,87C 'without':135C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Cronicle for scheduled jobs and give non-admin users the ability to create, edit or run events. The flaw needs an authenticated account with one of those privileges; installations where only administrators can manage events are less exposed. Instances already on 0.9.124 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","cronicle","package","selfhosted","taskscheduler"],"campaign_type":null,"first_public_at":"2026-09-04T16:18:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85076","severity":null,"published_at":"2026-11-05T21:18:54+00:00","modified_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","fetched_at":"2026-11-05T21:40:45+00:00","note":null}],"documents":[{"id":80394,"url":"https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80395,"url":"https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.124","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":80396,"url":"https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-9w42-v8cj-68gq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-04T16:18:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}