CVE-2026-107779: Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-14
Weakness: CWE-306

Description

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.

References

https://github.com/dromara/skyeye
https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.3.0/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java#L183-L231
https://github.com/dromara/skyeye/issues/29
https://www.vulncheck.com/advisories/dromara-skyeye-xxl-job-admin-missing-authentication-on-job-endpoints-allows-rce

Get alerted when CVE-2026-107779 or the next vulnerability affects your stack