Cronicle: Privilege escalation via uid/gid injection in event API
Summary
Cronicle, a multi-server task scheduler with a web UI and API, lets users with create_events and run_events rights (or a scoped API key) inject top-level uid and gid fields into events. Because launchJob copies the event into the job and the default shellplug and urlplug plugins do not define a uid, the injected identity is used at process launch. On a root-daemon installation, a low-privilege user can run jobs as any user, including root, bypassing the administrator-only run-as-user control.
Affected
- Cronicle versions before 0.9.121 (GHSA lists <= 0.9.120 as affected)
- Root-daemon installations are most severely affected
Fixed in
- Upgrade to Cronicle 0.9.121 or later
Workaround
Unknown. No vendor-published workaround found.
Exploitation
- No confirmed exploitation in the sources
- One aggregator lists no public proof of concept
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Identify all Cronicle instances and their versions and upgrade those at or below 0.9.120 to 0.9.121
- Until upgraded, restrict create_events and run_events rights and scoped API keys to trusted users
- Audit existing events for unexpected top-level uid or gid fields
- Avoid running the Cronicle daemon as root where the setup allows it
- Check whether the web UI or API is reachable from the internet and restrict access if not needed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9xpg-9w3g-mpwj github.com
- Fix commit f3d3550 github.com
- Cronicle release v0.9.121 github.com
- Strix CVE record CVE-2026-58255 www.strix.ai
- TheHackerWire CVE-2026-58255 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:42.
Original description (NVD)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.