CVE-2026-72589: Crontab-UI RCE Vulnerability

CVE-2026-72589 Overview

CVE-2026-72589 is an operating system (OS) command injection vulnerability in alseambusher/crontab-ui through version 0.4.2. The flaw resides in the POST /import endpoint, which accepts arbitrary .db files and overwrites the application database without validation. An unauthenticated remote attacker can import a crafted crontab database file to execute arbitrary system commands on the host. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the crontab-ui process, leading to full host compromise.

Affected Products

alseambusher/crontab-ui through version 0.4.2
Deployments exposing the /import endpoint to untrusted networks
Container and self-hosted installations running vulnerable versions

Discovery Timeline

2026-08-10 - CVE-2026-72589 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72589

Vulnerability Analysis

The vulnerability exists in the crontab-ui web interface, a Node.js application that provides a browser-based front end for managing Unix cron jobs. The POST /import route accepts a user-supplied .db file and writes it directly to the application's on-disk database. The application later reads job definitions from this database and passes fields into shell execution when scheduling or running cron entries.

Because the imported database is not validated, an attacker controls the exact contents of stored job records, including command strings. When crontab-ui processes these records, attacker-controlled data is passed to a shell interpreter, resulting in arbitrary OS command execution. The endpoint requires no authentication, so any actor able to reach the service over the network can trigger the flaw.

Root Cause

The root cause is a combination of missing input validation on the import handler and unsafe execution of database-sourced strings. The application treats the imported .db file as trusted state rather than untrusted input. Job records loaded from that state are concatenated into shell commands, satisfying the conditions for CWE-78. Refer to the crontab-ui repository and the crontab.js source for the affected code paths.

Attack Vector

An attacker sends an HTTP POST request to the /import endpoint with a crafted crontab database file. The payload defines one or more cron entries whose command fields contain shell metacharacters or additional commands. Once imported, the malicious jobs execute under the user account running crontab-ui, which is often a privileged service account. The attack requires network access to the exposed port and no user interaction.

Detection Methods for CVE-2026-72589

Indicators of Compromise

Unexpected POST /import requests in crontab-ui HTTP access logs from untrusted sources
Modification timestamps on the crontab-ui database file (crontabs/crontab.db) that do not correlate with legitimate administrative activity
New or altered cron entries containing shell metacharacters such as ;, |, `, or $(...)
Child processes spawned by the Node.js crontab-ui process that execute shells, network utilities (curl, wget, nc), or interpreters

Detection Strategies

Monitor web server and reverse proxy logs for requests to the /import path and alert on any request originating outside authorized management networks.
Inspect the crontab-ui database file for entries containing command chaining operators or references to reverse-shell payloads.
Correlate process creation events showing the crontab-ui or node process as parent of /bin/sh, /bin/bash, or scripting interpreters not part of legitimate jobs.

Monitoring Recommendations

Enable HTTP request logging on the crontab-ui service and forward logs to a centralized analytics platform for retention and search.
Alert on file integrity changes to the crontab-ui database directory outside of change-management windows.
Track outbound network connections initiated by the crontab-ui host to detect post-exploitation callbacks.

How to Mitigate CVE-2026-72589

Immediate Actions Required

Remove crontab-ui from any network segment reachable by untrusted clients, and restrict access to trusted administrator IP ranges only.
Place the service behind an authenticating reverse proxy that enforces credentials before requests reach the /import endpoint.
Audit the current crontab.db for unauthorized job entries and remove any that contain unexpected shell commands.
Rotate credentials and keys accessible from the crontab-ui host if exposure is suspected.

Patch Information

As of the NVD publication date, no fixed release has been enumerated in the CVE record. Consult the alseambusher/crontab-ui repository for the latest commits, releases, and security guidance. Until a vendor-supplied fix is confirmed, apply the workarounds below.

Workarounds

Block the /import route at the reverse proxy or web application firewall (WAF) layer for all clients.
Bind the crontab-ui listener to 127.0.0.1 and require SSH tunneling or a VPN for administrative access.
Run crontab-ui as an unprivileged user in an isolated container with a read-only filesystem where feasible to limit post-exploitation impact.
Enforce filesystem permissions on the crontabs/ directory so only the service account can read or write the database file.

bash

# Example nginx snippet to block the vulnerable endpoint
location = /import {
    deny all;
    return 403;
}

# Restrict the crontab-ui listener to localhost
export HOST=127.0.0.1
export PORT=8000
node app.js