Critical vulnerability found in cron-utils
Priority MEDIUM 42CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
Why it matters now
EPSS 0.04204 91st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial cron-utils (jmrozanec): 9.1.3com.cronutils:cron-utils (Maven): 9.1.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jmrozanec | cron-utils | before 9.1.3 | 9.1.3 | Patch available | CNA |
| — | com.cronutils:cron-utils (Maven) | before 9.1.3 | 9.1.3 | Patch available | GHSA-pfj3-56hm-jwq5 |
- cron-utils Vendorjmrozanec Affected before 9.1.3 Fixed in 9.1.3 Patch available CNA
- com.cronutils:cron-utils (Maven) Vendor— Affected before 9.1.3 Fixed in 9.1.3 Patch available GHSA-pfj3-56hm-jwq5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cron-utils_project:cron-utils:*:*:*:*:*:*:*:* | before 9.1.3 | Vulnerable | Cron-utils Project |
- cpe:2.3:a:cron-utils_project:cron-utils:*:*:*:*:*:*:*:* Versions before 9.1.3 Vulnerable ·Cron-utils Project
Remediation
- Fix · CNA cron-utils (jmrozanec) Fixed in 9.1.3
- Fix · GHSA-pfj3-56hm-jwq5 com.cronutils:cron-utils (Maven) Fixed in 9.1.3 Advisory →
Red Hat 3 advisories
- RHSA-2021:3207 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel Quarkus Tech-Preview 2 security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
- RHSA-2021:1004 Released 2021-03-29 · Red Hat rating ModerateRed Hat build of Quarkus 1.11.6 release and security update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:3207 |
| Text-Only RHOAR | Fixed | RHSA-2021:1004 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26238
- 2026-10-03 Alias added: GHSA-pfj3-56hm-jwq5
References
Exploit 2
Other 20
- [hive-issues] 20210316 [jira] [Assigned] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-dev] 20210316 [jira] [Created] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210316 [jira] [Work started] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-gitbox] 20210316 [GitHub] [hive] achennagiri opened a new pull request #2081: HIVE-24890: Upgrade the cron-utils library from 8.1.1 to 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210316 [jira] [Work logged] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210316 [jira] [Updated] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210317 [jira] [Commented] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210317 [jira] [Resolved] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-issues] 20210317 [jira] [Work logged] (HIVE-24890) Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
- [hive-gitbox] 20210317 [GitHub] [hive] yongzhi merged pull request #2081: HIVE-24890: Upgrade the cron-utils library from 8.1.1 to 9.1.3 due to CVE-2020-26238
- https://lists.apache.org/thread.html/r390bb7630b7ea8f02bf7adbbe69c0ae8b562c527d663c543d965f959@%3Cgitbox.hive.apache.org%3E
- https://lists.apache.org/thread.html/r432a69a1a85cbcb1f1bad2aa0fbfce0367bf894bf917f6ed7118e7f0@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b3dba46f343e23@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r5f601d15292e3302ad0ae0e89527029546945b1cd5837af7e838d354@%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r737406bc17d49ffe8fe6a8828d390ee0a02e45e5a5b4f931180b9a93@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r855aead591697dc2e85faf66c99036e49f492431940b78d4e6d895b5@%3Cgitbox.hive.apache.org%3E
- https://lists.apache.org/thread.html/r96937fc9c82f3201b59311c067e97bce71123944f93102169a95bf5c@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r9ae9a9fb1c8e2bf95c676e7e4cd06aa04f0a3a8a9ec1a6b787afb00f@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/ra9e81244d323898dde3c979dd7df6996e4037d14a01b6629ea443548@%3Cissues.hive.apache.org%3E
More Cron-utils Project Cron-utils vulnerabilities
- TI-2021-18101 Unauthenticated remote code injection in cron-utils CVSS 3.1CRITICAL 10.0
Sources
- CVE-2020-26238 · CVE Program
- CVE-2020-26238 · NVD
- FIRST EPSS
- GHSA-pfj3-56hm-jwq5 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26238 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences