{"metadata": {"vulnerability": "CVE-2026-85076", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-02T21:21:01.776Z", "date_only": false, "value": "2026-09-02T21:21:01.776Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T20:28:01.881Z", "date_only": false, "value": "2026-11-05T20:28:01.881Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T20:28:01.881Z", "date_only": false, "value": "2026-11-05T20:28:01.881Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-85076", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:57:33.493Z", "date_only": false, "value": "2026-11-05T20:57:33.493143Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117565833415145790", "record": "CVE-2026-85076", "field": "creation_timestamp", "uuid": "26acd073-da2e-4c2c-b67f-7ce51613e143", "content": "CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.\nhttps://www.cve.org/CVERecord?id=CVE-2026-85076https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-9w42-v8cj-68gqhttps://github.com/jhuckaby/Cronicle/commit/da0228fdea9bc57c09876c00ea0feda70a0ef110https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.124#jhuckaby #Cronicle#CVE_2026_85076#bot", "url": "https://infosec.exchange/users/cve/statuses/117565833415145790"}, {"timestamp": "2026-11-05T21:18:54.217Z", "date_only": false, "value": "2026-11-05T21:18:54.217", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85076", "record": "FKIE_CVE-2026-85076", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T22:40:03.475Z", "date_only": false, "value": "2026-11-05T22:40:03.475262Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlwqm6zoq25", "record": "CVE-2026-85076", "field": "creation_timestamp", "uuid": "b6c5ed6c-9bbd-4324-877b-464020f8fe50", "content": "CVE-2026-85076 - cronicle\nIn Cronicle versions before 0.9.124, a user who can create or edit scheduled jobs can add unexpected items to the job\u2019s environment variables. By inserting a variable that matches\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cronicle #jhuckaby #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlwqm6zoq25"}, {"timestamp": "2026-11-09T17:37:08.274Z", "date_only": false, "value": "2026-11-09T17:37:08.274451Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85076", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T17:37:08.274Z", "date_only": false, "value": "2026-11-09T17:37:08.274451Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85076", "record": "FKIE_CVE-2026-85076", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T17:42:22.697Z", "date_only": false, "value": "2026-11-09T17:42:22.697Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T17:42:22.697Z", "date_only": false, "value": "2026-11-09T17:42:22.697Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85076", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:52:11.958Z", "date_only": false, "value": "2026-11-12T14:52:11.958085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3m34dith7x6un", "record": "CVE-2026-85076", "field": "creation_timestamp", "uuid": "dc6e2cd4-4dd0-4a1c-8a76-125281bac1be", "content": "\ud83d\udea8 CVE-2026-85076\nCVSS 9.0 / EPSS 0.4% / KEV: No\nTL;DR: Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or\u2026\nhttps://cvesentinel.com/report/CVE-2026-85076\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3m34dith7x6un"}, {"timestamp": "2026-11-12T22:18:51.470Z", "date_only": false, "value": "2026-11-12T22:18:51.470", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85076", "record": "FKIE_CVE-2026-85076", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T23:37:25.025Z", "anchors": {"origin": {"timestamp": "2026-11-05T20:28:01.881Z", "date_only": false, "value": "2026-11-05T20:28:01.881Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T20:28:01.881Z", "date_only": false, "value": "2026-11-05T20:28:01.881Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 616163.144814, "hours": 171.156429115, "days": 7.131517879791667, "min_seconds": 616163.144814, "max_seconds": 616163.144814, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T20:28:01.881Z", "date_only": false, "value": "2026-11-05T20:28:01.881Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T23:37:25.025Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}