# CVE-2026-58255: Cronicle privilege escalation via event field injection

Source: https://junglewise.ai/threats/cve-2026-58255-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-58255 · Severity: high · CVSS 8.8 · Published 2026-10-27

Cronicle is a multi-server task scheduler that runs on servers including as root. Users with limited permissions can inject fields into scheduled jobs to run them as arbitrary users, including root, gaining full system control. This affects installations where Cronicle runs with elevated privileges.

Technologies: [Cronicle](https://junglewise.ai/threats/technologies/cronicle). Vendors: [Cronicle](https://junglewise.ai/threats/vendors/cronicle).

## Quick answers

**Is CVE-2026-58255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58255 being exploited in the wild.

**How severe is CVE-2026-58255?** High severity, with a CVSS score of 8.8, published 27 October 2026.

**Which products and versions are affected?** Cronicle before 0.9.121.

**Is there a fix for CVE-2026-58255?** Yes: fixed in 0.9.121. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58255 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58255?** Check whether you run Cronicle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.121

## Technical details

A privilege escalation vulnerability allows non-administrator users or scoped API keys with `create_events` and `run_events` privileges to inject `uid` and `gid` fields via `/api/app/create_event` or `/api/app/update_event` endpoints. The vulnerability stems from incomplete validation in `requireValidEventData` that silently passes unknown keys through to job execution. On root-daemon installations, injected uid/gid values override default plugin settings and execute child processes with attacker-specified privileges.

## Affected products

- Cronicle Cronicle before 0.9.121

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/jhuckaby/Cronicle/commit/f3d3550d0f3fe89bab52d3788f0db1dd10860df2](https://github.com/jhuckaby/Cronicle/commit/f3d3550d0f3fe89bab52d3788f0db1dd10860df2)
- [https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.121](https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.121)

## Related threats

- [Cronicle stored XSS in Activity Log via user full name](https://junglewise.ai/threats/cve-2026-55562-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [jhuckaby Cronicle missing authorization in job output parser](https://junglewise.ai/threats/cve-2026-39401-jhuckaby-cronicle-missing-authorization-in-job-output-parser)
- [Cronicle stored XSS in job output fields](https://junglewise.ai/threats/cve-2026-39400-cronicle-stored-xss-in-job-output-fields)