CVE-2026-107779: Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of Dromara Skyeye that include the bundled xxl-job-admin code at commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 are exposed where an attacker can reach the JobInfoController endpoints.
What does an attacker need to exploit this issue?
The attacker needs network access to submit a POST request to /jobinfo/addAndStart. No authentication, privileges, or user interaction are required; the request can define a GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL job with attacker-controlled glueSource.
How can I determine whether the vulnerable behavior is present?
Check whether the bundled xxl-job-admin JobInfoController exposes /jobinfo/addAndStart with @PermissionLimit(limit = false). Also verify whether the deployment permits creation of GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs through that endpoint.
What is the operational impact beyond command execution?
An unauthenticated attacker can execute commands on the executor host through submitted jobs. They can also stop and delete jobs, which can disrupt scheduled task processing.