CVE-2026-7306: Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key
A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument defaulttoken leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7306?
CVE-2026-7306 has been classified as a high-severity vulnerability due to the hard-coded key present in the OpenApiController.java file.
How do I fix CVE-2026-7306?
To fix CVE-2026-7306, upgrade Xuxueli xxl-job to a version higher than 3.3.2 where this vulnerability has been addressed.
What is the affected software in CVE-2026-7306?
The affected software for CVE-2026-7306 is Xuxueli xxl-job, specifically versions up to and including 3.3.2.
What component does CVE-2026-7306 impact?
CVE-2026-7306 impacts the OpenApiController.java file within the xxl-job-admin module.
Why is CVE-2026-7306 a concern for developers?
CVE-2026-7306 is a concern for developers because the presence of a hard-coded key can lead to unauthorized access and security breaches.