CRITICAL 9.3 NVD
CVE-2026-107779
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoControlle
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
References
- https://github.com/dromara/skyeye
- https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.
- https://github.com/dromara/skyeye/issues/29
- https://www.vulncheck.com/advisories/dromara-skyeye-xxl-job-admin-missing-authentication-o
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-08 via NVD.
Risk Timeline
CVE Disclosed2026-10-08 · 3 days ago
Remediation Resources
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.