# CVE-2026-39401: jhuckaby Cronicle missing authorization in job output parser

Source: https://junglewise.ai/threats/cve-2026-39401-jhuckaby-cronicle-missing-authorization-in-job-output-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-39401 · Severity: medium · CVSS 5.4 · Published 2026-04-07

Cronicle is a task scheduling and management tool used to automate server operations. A security flaw allows users with basic permissions to modify system-level task configurations that they should not be able to access. By running a specially crafted script, an attacker could redirect notifications to their own servers, potentially intercepting sensitive environment variables, internal network details, and script contents.

Technologies: [Cronicle](https://junglewise.ai/threats/technologies/cronicle). Vendors: [Cronicle](https://junglewise.ai/threats/vendors/cronicle).

## Quick answers

**Is CVE-2026-39401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39401 being exploited in the wild.

**How severe is CVE-2026-39401?** Medium severity, with a CVSS score of 5.4, published 7 April 2026.

**Which products and versions are affected?** jhuckaby Cronicle < 0.9.111.

**Is there a fix for CVE-2026-39401?** A patch was published on 2026-04-07: Fix released in version 0.9.111 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39401 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39401?** Check whether you run Cronicle. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check in the job output parser (lib/job.js) allows child processes to include an 'update_event' key in their JSON output. The server applies these updates directly to the parent event's stored configuration in the 'global/schedule' list without verifying the user's permissions. An attacker with 'create_events' or 'run_events' privileges can exploit this to overwrite event properties such as 'web_hook' or 'notify_success'. This can lead to the exfiltration of job objects—containing environment variables and internal IPs—to attacker-controlled endpoints. The issue is fixed in version 0.9.111 by restricting the allowed keys in job output.

## Affected products

- jhuckaby Cronicle < 0.9.111

## Timeline

- 2026-04-03: advisory: Vendor advisory published on GitHub
- 2026-04-07: disclosed: CVE published to NVD
- 2026-04-07: patched: Fix released in version 0.9.111

## References

- [https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v](https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v)

## Related threats

- [Cronicle privilege escalation via event field injection](https://junglewise.ai/threats/cve-2026-58255-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [Cronicle stored XSS in Activity Log via user full name](https://junglewise.ai/threats/cve-2026-55562-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [Cronicle stored XSS in job output fields](https://junglewise.ai/threats/cve-2026-39400-cronicle-stored-xss-in-job-output-fields)