Critical 9.3

CVE-2026-107779

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.

Scores

CVSS out of 10, critical severity.

EPSS chance of exploitation in the next 30 days.

The facts

Published

8 October 2026

Last changed

14 October 2026

NVD status

Deferred

Severity

Critical, CVSS 9.3 out of 10 (version 4.0)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R…

Weakness

Missing authentication for a critical function (CWE-306)

Known exploited

Not in the CISA Known Exploited Vulnerabilities catalogue in this build.

EPSS

0.5% chance of exploitation activity in the next 30 days (percentile 44).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

Scores

The facts

Is there a Securelyn advisory?

References