CVE-2026-106708

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-19
Weakness: CWE-352

Description

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

References

https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md
https://github.com/xuxueli/xxl-job

Get alerted when CVE-2026-106708 or the next vulnerability affects your stack