CVE-2026-107779CWE-306

CVE-2026-107779

Critical · published October 9, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-09T01:17Z
References (4)
https://github.com/dromara/skyeye · [email protected]https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.3.0/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java#L183-L231 · [email protected]https://github.com/dromara/skyeye/issues/29 · [email protected]https://www.vulncheck.com/advisories/dromara-skyeye-xxl-job-admin-missing-authentication-on-job-endpoints-allows-rce · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 08 OCT 20:15Z
    Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
    cvelistv5
  • 08 OCT 20:15Z
    Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
    cvelistv5