CVE-2026-107779 in Skyeye
Summary
by MITRE • 10/09/2026
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Dromara Skyeye prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 represents a critical authentication bypass within the xxl-job-admin component, specifically affecting the JobInfoController endpoints. This flaw stems from the improper configuration of access control mechanisms for specific API routes that are annotated with @PermissionLimit(limit = false). In typical implementations of such frameworks, this annotation is intended to designate endpoints as public or exempt from strict permission checks under controlled circumstances. However, in this context, it inadvertently exposes sensitive administrative functions to unauthenticated actors. The affected endpoints include those responsible for managing job definitions and execution states, which are fundamental components of any distributed task scheduling system. By failing to enforce authentication on these routes, the application allows external entities to interact with core functionality without providing valid credentials or session tokens, thereby violating the principle of least privilege and proper access control enforcement.
The technical exploitation vector involves sending HTTP POST requests to the /jobinfo/addAndStart endpoint with specific parameters that trigger GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL job types. The term GLUE refers to a scripting mechanism within xxl-job that allows users to write custom business logic in various programming languages directly through the admin interface rather than compiling Java code. When an attacker supplies a malicious glueSource payload containing arbitrary commands for shell execution, Python scripts, or PowerShell instructions, the backend processes this input and schedules it for immediate execution on one of the connected executor nodes. This mechanism is designed to facilitate rapid prototyping and flexible job definition but lacks sufficient sanitization and validation when accessed via unauthenticated routes. Consequently, an attacker can inject system commands that are executed with the privileges of the user account running the xxl-job-executor service. This effectively transforms a task scheduling tool into a remote code execution vector, allowing for complete compromise of the underlying infrastructure hosting the executor agents.
The operational impact of this vulnerability is severe and multifaceted. First, it enables Remote Code Execution (RCE) on any host where an xxl-job executor is deployed and connected to the vulnerable admin server. Attackers can execute arbitrary system commands, leading to data exfiltration, lateral movement within the network, or complete system takeover depending on the permissions of the executing process. Second, the vulnerability allows for denial-of-service conditions by enabling attackers to stop existing jobs or delete job configurations entirely. This disruption impacts business continuity and operational reliability, as scheduled tasks critical for data processing, reporting, or synchronization may fail silently or be removed from the queue without authorization. The ability to manipulate job states also complicates forensic analysis and incident response efforts, as malicious activities can be masked by legitimate-looking task modifications. Furthermore, since xxl-job is often used in enterprise environments handling sensitive data, this breach poses significant risks to confidentiality, integrity, and availability of organizational assets.
From a classification perspective, this vulnerability aligns with CWE-287: Improper Authentication, as the system fails to verify identity before granting access to administrative functions. It also relates closely to CWE-94: Improper Control of Generation of Code (Code Injection), specifically through the injection of executable scripts via the glueSource parameter. In terms of attack tactics, this scenario maps directly to MITRE ATT&CK technique T1059: Command and Scripting Interpreter, where adversaries use scripting languages like PowerShell or Python to execute commands on compromised systems. Additionally, it falls under T1486: Data Encrypted for Impact if the executed scripts are used for ransomware deployment, although the primary immediate threat is unauthorized command execution and service disruption. The lack of authentication combined with code injection capabilities creates a high-severity risk profile that requires immediate remediation to prevent exploitation in production environments where such scheduling tools are commonly deployed.
Mitigation strategies must address both the architectural flaw and the specific implementation details. The most effective solution is to remove or correct the @PermissionLimit(limit = false) annotation on all JobInfoController endpoints, ensuring that authentication and authorization checks are enforced for any operation involving job creation, modification, or execution. Access control lists should be configured to restrict these administrative functions exclusively to authorized personnel with valid credentials. Additionally, input validation must be strengthened by sanitizing the glueSource parameter to prevent code injection attacks, even if access is properly restricted. Implementing network-level controls such as firewalls or reverse proxies that limit access to the admin interface to trusted IP addresses can provide an additional layer of defense in depth. Regular security audits and penetration testing should be conducted to identify similar misconfigurations across other modules within the Dromara Skyeye ecosystem. Organizations relying on this software should apply the patch included in commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 or later versions immediately to close these critical security gaps and restore secure operational integrity.