CVE-2026-3733: xuxueli xxl-job JobInfoController.java server-side request forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-08 · updated 2026-06-17
Weakness: CWE-918

Description

A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)

Affected products

Xuxueli xxl-job: 3.3.0, 3.3.1, 3.3.2

References

https://github.com/xuxueli/xxl-job/
https://github.com/xuxueli/xxl-job/issues/3924
https://github.com/xuxueli/xxl-job/issues/3924#issue-3987941359
https://vuldb.com/?ctiid.349711
https://vuldb.com/?id.349711
https://vuldb.com/?submit.767226

Get alerted when CVE-2026-3733 or the next vulnerability affects your stack