Is CVE-2026-72590 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72590?

CVE-2026-72590 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-72590

Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.