CVE-2026-39401

Vulnerability

Cronicle prior to 0.9.111 accepts an update_event key in JSON output from job child processes. The server applies this key directly to the parent event's stored configuration without any authorization check [1]. This flaw exists in the job output parser and the update logic in lib/job.js [1].

Exploitation

A low-privilege user with create_events and run_events privileges can craft a shell script event that outputs JSON containing an update_event object. For example, the output can set a new webhook URL or notification email. When the job runs, the server updates the event configuration with the attacker-controlled values [1].

Impact

Successful exploitation allows an attacker to redirect webhook notifications to an attacker-controlled server, exfiltrating sensitive job data such as script contents, environment variables, and internal network information. Additionally, the attacker can change notification email addresses to intercept alerts [1].

Mitigation

The vulnerability is fixed in Cronicle version 0.9.111. The fix removes update_event from the allowed keys in the job output parser or adds proper authorization checks before applying updates [1].