---
id: "CVE-2026-85076"
page: "https://infrastack.ai/live/CVE-2026-85076"
kind: "vulnerability"
aliases: ["CVE-2026-85076"]
title: "Cronicle: authenticated users can inject environment variables into job processes"
severity: "critical"
cvss: 9.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cronicle", "package", "self-hosted", "task-scheduler"]
not_affected_if: ["admin-only-events", "version-0.9.124-or-later"]
published_at: "2026-11-05T21:18:54+00:00"
first_seen_at: "2026-11-05T21:40:45+00:00"
updated_at: "2026-11-05T21:41:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85076", "first_seen_at": "2026-11-05T21:40:45+00:00"}]
exploit_sources: []
---

# Cronicle: authenticated users can inject environment variables into job processes

Link for people: https://infrastack.ai/live/CVE-2026-85076 (this .md is for agents)

Cronicle is a multi-server task scheduler with a web UI. Before 0.9.124, a logged-in non-admin user with event create, edit or run rights can pass arbitrary keys in event parameters that become environment variables for job processes, which can override the plugin execution context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cronicle version: `0.9.124` or later is fixed; anything earlier is affected.
- Review which accounts hold run_events, create_events or edit_events privileges.

## Fix

- Cronicle: upgrade to `0.9.124`.

## Timeline

- 2026-11-05T21:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85076

## Documents

- [advisory] Vendor advisory: github.com https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-9w42-v8cj-68gq
- [fix] Patch: github.com https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110
- [fix] Release notes: github.com https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.124

## From the sources

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_