PT-2026-29569 · Unknown · Cronmaster

Qiaonpc · CVE-2026-34072 · Published 2026-04-01 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cr*nMaster versions prior to 2.2.0

Description Cr*nMaster is a Cronjob management UI. Prior to version 2.2.0, an authentication bypass exists in the middleware. When the middleware’s session-validation fetch fails, unauthenticated requests with an invalid session cookie are incorrectly treated as authenticated. This can lead to unauthorized access to protected pages and the unauthorized execution of privileged Next.js Server Actions.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

Protection Mechanism Failure

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-693

CWE-287

CWE-306

Related Identifiers

CVE-2026-34072

GHSA-9WHH-MFFV-XVH6

Affected Products

Cronmaster

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34072.json · Exploit
• https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34072 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34072 · Vendor Advisory
• https://github.com/fccview/cronmaster/releases/tag/2.2.0 · Note
• https://twitter.com/TheHackerWire/status/2039613800576680444 · Twitter Post
• https://t.me/cveNotify/165661 · Telegram Post
• https://twitter.com/dailycve/status/2061884345632076189 · Twitter Post