CVE-2026-52371: SSRF

Published Jul 31, 2026

Updated

A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request.

Affected Software

1 affected component

XXL-Job XXL-Job=3.4.0

Event History

Jul 31, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must be authenticated. The CVSS vector indicates the issue is remotely exploitable with low attack complexity and requires no user interaction.

What is the expected security impact?

The CVSS assessment indicates high confidentiality impact, with no integrity or availability impact. The stated capability is scanning resources through a crafted HTTP request.

Which release is identified as affected?

The provided data identifies xxl-job v3.4.0.

Does exploitation affect resources beyond the vulnerable component's security scope?

No. The CVSS vector lists scope as unchanged.

CVE-2026-52371: SSRF

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What is the expected security impact?

Which release is identified as affected?

Does exploitation affect resources beyond the vulnerable component's security scope?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the expected security impact?

Which release is identified as affected?

Does exploitation affect resources beyond the vulnerable component's security scope?