Is CVE-2026-34072 actively exploited?

No active exploitation of CVE-2026-34072 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34072 be exploited remotely?

Partially. CVE-2026-34072 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-34072?

CVE-2026-34072 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2026-34072

HIGH

CVE-2026-34072

CWE-287Published: April 1, 2026· Updated: Apr 3, 2026

8.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.8th

Official Description

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.

NVD Source

Technical Analysis

CVE-2026-34072 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.3.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.