CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
Unauthenticated attackers can execute arbitrary commands on executor hosts by submitting malicious jobs to unprotected xxl-job-admin endpoints in Dromara Skyeye.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107779?
CVE-2026-107779 is a critical missing authorization vulnerability in dromara skyeye, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
Weakness: CWE-306
Which versions are affected by CVE-2026-107779?
How do I fix CVE-2026-107779?
No fix has been published for CVE-2026-107779 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-107779 being exploited?
There is no known exploitation of CVE-2026-107779 in the wild and no public exploit code.
Sources
Also known as GHSA-2h33-hvx5-jq32.