CVE-2026-107779

Executive Summary

CVE-2026-107779 is a critical missing authentication vulnerability (CWE-306) in Dromara Skyeye, affecting the bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated, remote attackers can submit GLUE script jobs (GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL) with attacker-controlled glueSource content to the /jobinfo/addAndStart endpoint, resulting in remote command execution on the executor host or the ability to stop and delete jobs. With a CVSS 3.1 base score of 9.8 and no patch available, any internet-exposed or network-reachable Skyeye deployment is at immediate risk of full compromise.

Technical Analysis

The vulnerability resides in Dromara Skyeye's integration of the xxl-job-admin scheduling component. xxl-job is a distributed task scheduling framework in which an admin server communicates with executor nodes that run scheduled jobs. Certain endpoints within JobInfoController are annotated with @PermissionLimit(limit = false). In xxl-job's design, this annotation signals that the endpoint intentionally bypasses the permission interceptor — meaning no authentication or authorization check is applied before the request is processed.

Because these endpoints are exposed without authentication, an attacker with network reachability to the admin interface can invoke JobInfoController functionality directly. The NVD description specifically identifies the /jobinfo/addAndStart endpoint as the attack vector. This endpoint creates and immediately starts a job. The supported GLUE task types — GLUE_SHELL, GLUE_PYTHON, and GLUE_POWERSHELL — allow the job's logic to be supplied as raw source code via the glueSource parameter. When a GLUE job is triggered, the executor host writes the supplied source to a temporary script file and executes it using the corresponding interpreter (shell, Python, or PowerShell).

The result is a direct path from an unauthenticated HTTP request to arbitrary command execution on any registered executor host. The same unauthenticated access also permits stopping and deleting existing jobs, enabling denial-of-service or sabotage of scheduled workloads and disruption of dependent business processes.

The root cause is a design decision that maps @PermissionLimit(limit = false) to "disable authentication" rather than "require a lower privilege tier," combined with the exposure of job-creation endpoints that accept arbitrary executable source. This is a classic missing-authentication flaw (CWE-306): the application does not perform any authentication for functionality that requires a provable user identity.

Note: No public proof-of-concept code, Nuclei template, or exploit code was observed at the time of this report. The technical description above is derived strictly from the NVD description and standard xxl-job GLUE execution semantics; no specific implementation details beyond those in the description are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-306 — missing authentication) and the endpoint and parameters named in the NVD description. Only identifiers explicitly present in the description are used.

1. Reconnaissance / Target Identification. An attacker scans for internet-exposed or internally reachable Dromara Skyeye instances that bundle xxl-job-admin. Identification can be performed via fingerprinting of the admin login page or the /jobinfo/ API surface. Shodan dorks such as http.title:"Skyeye" or http.html:"xxl-job" assist in locating exposed instances.

2. Triggering the Flaw Class. Because the affected JobInfoController endpoints are annotated @PermissionLimit(limit = false), the permission interceptor is bypassed. The attacker sends an unauthenticated HTTP POST request to /jobinfo/addAndStart. No credentials, session token, or API key are required — the missing-authentication condition allows the request to reach the controller directly.

3. Payload / Execution Method. In the POST body, the attacker supplies a job definition with a GLUE task type of GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL, and provides arbitrary source in the glueSource field. The endpoint creates and starts the job. The xxl-job executor host subsequently materializes and executes the supplied source with the corresponding interpreter, granting the attacker code execution in the executor's runtime context. Command execution is limited only by the privileges of the executor process.

4. Post-Exploitation Impact. With code execution on the executor host, an attacker can establish persistence, exfiltrate data, pivot to other internal systems reachable from the executor, or deploy additional tooling. Separately, the same unauthenticated endpoint surface permits stopping and deleting existing jobs, enabling disruption or sabotage of legitimate scheduled workloads and dependent business processes.

Impact Assessment

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 9.8 (Critical). Each subscore maps directly to the vulnerability:

• AV:N (Network): Exploitable remotely over the network; no physical or adjacent access needed.
• AC:L (Low): No special conditions or race windows; a single crafted request suffices.
• PR:N (None): No privileges or authentication required — the core of the flaw.
• UI:N (None): No user interaction required.
• S:U (Unchanged): Impact is scoped to the vulnerable component's security authority.
• C:H / I:H / A:H: High confidentiality, integrity, and availability impact — code execution exposes data, permits modification, and enables destruction or denial of service.

Business impact includes full host compromise of any xxl-job executor reachable by the admin server, lateral movement into trusted internal networks, exfiltration of sensitive data processed by scheduled jobs, disruption of critical business workflows through job deletion, and potential supply-chain or downstream effects where Skyeye/xxl-job orchestrates other systems. The blast radius is determined by the number of executor nodes registered and the network privileges of those hosts. Internet-exposed deployments face the greatest risk. EPSS has not yet been scored by FIRST.org; no value is asserted here. CISA KEV status is NO.

Detection Guidance

Sigma Rule

title: Dromara Skyeye xxl-job Unauthenticated Job Creation (CVE-2026-107779)
id: 0f6c9a2e-7b41-4d8e-9c3f-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated POST requests to the xxl-job-admin /jobinfo/addAndStart endpoint that specify GLUE task types, consistent with CVE-2026-107779
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107779
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/jobinfo/addAndStart'
  selection_method:
    cs-method: 'POST'
  selection_glue:
    - cs-uri-query|contains: 'GLUE_SHELL'
    - cs-uri-query|contains: 'GLUE_PYTHON'
    - cs-uri-query|contains: 'GLUE_POWERSHELL'
    - body|contains: 'glueSource'
  condition: selection_endpoint and selection_method and selection_glue
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrative job creation from trusted management hosts
level: critical

YARA Rule

rule CVE_2026_107779_Skyeye_XXLJob_GLUE_RCE
{
    meta:
        description = "Detects HTTP request artifacts targeting Dromara Skyeye xxl-job-admin /jobinfo/addAndStart with GLUE task types (CVE-2026-107779)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107779"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ep   = "/jobinfo/addAndStart" ascii wide nocase
        $glue1 = "GLUE_SHELL" ascii wide nocase
        $glue2 = "GLUE_PYTHON" ascii wide nocase
        $glue3 = "GLUE_POWERSHELL" ascii wide nocase
        $src  = "glueSource" ascii wide nocase

    condition:
        $ep and $src and any of ($glue*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107779 Dromara Skyeye xxl-job Unauthenticated GLUE Job RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/jobinfo/addAndStart"; nocase; http.request_body; content:"glueSource"; nocase; http.request_body; content:"GLUE_SHELL"; nocase; sid:2026107779; rev:1; metadata:affected_product Dromara_Skyeye, cve CVE-2026-107779, created_at 2026_01_01; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107779;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "POST" and url.path : "/jobinfo/addAndStart"]
  [network where http.request.body contains "glueSource" and (http.request.body contains "GLUE_SHELL" or http.request.body contains "GLUE_PYTHON" or http.request.body contains "GLUE_POWERSHELL")]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem, request_path)
| eval method=coalesce(method, cs_method, http_method)
| eval body=coalesce(body, request_body, cs_request_body)
| where like(uri, "%/jobinfo/addAndStart%") AND upper(method)="POST"
| search body="*glueSource*" AND (body="*GLUE_SHELL*" OR body="*GLUE_PYTHON*" OR body="*GLUE_POWERSHELL*")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources values(uri) as endpoints by dest, host
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,xxl_job,skyeye,">
  <rule id="1077790" level="12">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <url path="/jobinfo/addAndStart" />
    <field name="request_body" type="pcre2">(?i)glueSource</field>
    <field name="request_body" type="pcre2">(?i)GLUE_(SHELL|PYTHON|POWERSHELL)</field>
    <description>CVE-2026-107779: Unauthenticated GLUE job execution attempt against Dromara Skyeye xxl-job /jobinfo/addAndStart</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_admin,cve_2026_107779,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently available.

1) Immediate mitigations

• Remove or block network access to xxl-job-admin endpoints such as /jobinfo/addAndStart at the perimeter (WAF, reverse proxy, firewall ACLs). Only trusted management hosts should reach the admin interface.
• Never expose the Skyeye/xxl-job-admin service directly to the internet.
• Disable or restrict the GLUE task types (GLUE_SHELL, GLUE_PYTHON, GLUE_POWERSHELL) if the deployment does not require them.
• Enforce authentication in front of the admin UI via a reverse proxy or identity-aware gateway.
• Review existing job definitions for unauthorized jobs and unexpected GLUE source content, and audit executor hosts for indicators of execution.

2) Patch / upgrade steps

• No patch is available for CVE-2026-107779 as of this report. Monitor the Dromara Skyeye project and the upstream xxl-job project for a fix commit or release, and apply it as soon as it is published.
• Track the project repository beyond vulnerable commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

3) Long-term hardening

• Apply network segmentation between the admin server and executor hosts; limit executor reachability.
• Enforce least privilege on executor service accounts so compromised jobs cannot pivot broadly.
• Remove or correctly scope @PermissionLimit(limit = false) annotations so that administrative endpoints always require authentication.
• Deploy the detection rules in this report and centralize logs from the admin server and executor hosts.
• Maintain an inventory of internet-exposed schedulers and periodically reassess fingerprint exposure via Shodan.

References

• NVD — CVE-2026-107779: https://nvd.nist.gov/vuln/detail/CVE-2026-107779
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Dromara Skyeye project repository (commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321): https://github.com/dromara/skyeye
• xxl-job upstream project (GLUE task execution semantics): https://github.com/xuxueli/xxl-job
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-107779 not listed at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template was identified. No threat actor campaign or in-the-wild exploitation evidence was observed at the time of this report.