Privilege Escalation Vulnerability in Cronicle Multi-Server Task Scheduler

CVE-2026-85076

What is CVE-2026-85076?

The security issue in Cronicle arises when an authenticated non-admin user with the 'run_events', 'create_events', or 'edit_events' privileges supplies undeclared keys in event parameters via specific API calls. This lack of key restriction in the parameter object allows these keys to override security-sensitive environment variables during the execution of plugins. Consequently, this can lead to a range of severe implications, including privilege escalation, arbitrary code execution, unauthorized data access, or disruption of services, depending on the executed plugin and the runtime environment. This vulnerability has been resolved in version 0.9.124.

References