PatchSiren

jhuckaby CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jhuckaby CVE published 2026-04-07

CVE-2026-39401

CVE-2026-39401 is a vulnerability in Cronicle, a multi-server task scheduler and runner. Prior to version 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and no [truncated]