CVE-2026-72590 Overview
CVE-2026-72590 is an OS command injection vulnerability in alseambusher/crontab-ui through version 0.4.2. The flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to the /crontab endpoint. The attack uses URL-encoded newline characters in the env_vars parameter to break out of the intended input context. Successful exploitation leads to arbitrary command execution under the privileges of the crontab-ui process. The vulnerability is classified as [CWE-93] Improper Neutralization of CRLF Sequences.
Critical Impact
Unauthenticated remote attackers can inject arbitrary cron entries and achieve command execution on affected hosts.
Affected Products
- alseambusher/crontab-ui versions through 0.4.2
- Deployments exposing the crontab-ui web interface to untrusted networks
- Container images and self-hosted instances built from vulnerable releases
Discovery Timeline
- 2026-08-10 - CVE-2026-72590 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-72590
Vulnerability Analysis
The vulnerability resides in the crontab-ui web application's handling of the env_vars parameter on the /crontab route. The application accepts user-supplied environment variable data and writes it into the crontab configuration without neutralizing newline characters. An attacker who supplies URL-encoded %0A sequences can terminate the current line and inject additional cron entries. Cron then executes those attacker-controlled entries on schedule, resulting in command execution.
Because the endpoint does not require authentication, exploitation requires only network reachability to the crontab-ui service. The attack is executed through a single GET request, requires no user interaction, and the attacker controls both the timing and command payload of the injected job.
Root Cause
The root cause is improper neutralization of CRLF sequences [CWE-93] in input written to the crontab file. The application treats env_vars as a single-line value but does not strip or encode newline characters before serializing the input. Cron's line-based syntax then interprets injected newlines as new job definitions.
Attack Vector
An attacker sends a crafted GET request to /crontab with the env_vars parameter containing URL-encoded newline characters followed by a valid cron schedule and command. The application appends the payload to its crontab configuration, and the scheduler executes the injected command at the specified interval. No credentials, tokens, or session state are required. See the crontab-ui source repository and app.js source file for the request handler implementation.
Detection Methods for CVE-2026-72590
Indicators of Compromise
- HTTP GET requests to /crontab containing %0A or literal newline sequences in the env_vars query parameter
- Unexpected entries in the crontab-ui data store or the system crontab referencing unfamiliar binaries or network destinations
- Outbound connections from the crontab-ui host to attacker-controlled infrastructure shortly after cron trigger intervals
- Child processes spawned by the cron daemon that do not match documented scheduled jobs
Detection Strategies
- Inspect web server and reverse proxy logs for requests to /crontab with URL-encoded control characters in query parameters
- Monitor file integrity on the crontab-ui configuration files and the system crontab for out-of-band modifications
- Alert on cron-spawned processes that execute shells, download utilities, or interpreters outside of an approved baseline
Monitoring Recommendations
- Forward web access logs and process telemetry from crontab-ui hosts to a centralized analytics platform for correlation
- Baseline the set of scheduled jobs and alert on additions, deletions, or modifications
- Track parent-child process relationships originating from cron or crond to identify anomalous execution chains
How to Mitigate CVE-2026-72590
Immediate Actions Required
- Restrict network access to the crontab-ui interface using firewall rules, VPN, or a reverse proxy with authentication
- Take publicly exposed instances offline until an upstream fix is validated and deployed
- Audit existing cron entries on affected hosts and remove any jobs that were not created by authorized administrators
- Rotate credentials and secrets accessible from the crontab-ui host if exposure to untrusted networks is suspected
Patch Information
At the time of publication, no fixed release is referenced in the CVE record. Monitor the alseambusher/crontab-ui GitHub repository for security releases addressing the env_vars input handling. Apply the patched version as soon as it is available and redeploy any container images built from vulnerable base versions.
Workarounds
- Place crontab-ui behind an authenticating reverse proxy that rejects requests containing URL-encoded control characters in query strings
- Bind the crontab-ui service to localhost and access it through an SSH tunnel rather than exposing it on a network interface
- Deploy a web application firewall rule that blocks %0A, %0D, and raw CRLF bytes in the env_vars parameter
- Run crontab-ui as a least-privileged user in a dedicated container with a read-only root filesystem to limit post-exploitation impact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
