API Event Injection Vulnerability in Cronicle Multiple Server Task Scheduler
CVE-2026-58255
What is CVE-2026-58255?
Cronicle, a multi-server task scheduler, contains a vulnerability that allows a low-privileged user or API key with certain privileges to inject unauthorized 'uid' and 'gid' fields through its API. Specifically, before version 0.9.121, an attacker can exploit the '/api/app/create_event' or '/api/app/update_event' endpoints. The vulnerable code fails to adequately validate and restrict the data that can be submitted, allowing malicious input to be processed unfiltered. Consequently, this enables attackers to control the user context under which scheduled tasks are executed, potentially allowing arbitrary task execution as any user, including elevated permissions like root. This vulnerability has been mitigated in version 0.9.121.
Affected Version(s)
Cronicle < 0.9.121