Signal is active with 14 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE jhuckaby Cronicle: privilege escalation via env var injection in event params (CVE-2026-85076) Low-privilege users can inject environment variables into plugin processes to escalate privileges or run code. Patch → 0.9.124 https://cve.now/CVE-2026-85076?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://www.cve.org/CVERecord?id=CVE-2026-85076 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://www.cve.org/CVERecord?id=CVE-2026-85076 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering
CVE-2026-85076: CVSS 9.0 critical advisory is out Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. https://www.cve.org/CVERecord?id=CVE-2026-85076 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering