CVE-2026-107779

Name of the Vulnerable Software and Affected Versions Dromara Skyeye versions prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

Description A missing authentication issue exists in the bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can send requests to the /jobinfo/addAndStart endpoint by providing attacker-supplied glueSource for GLUE SHELL, GLUE PYTHON, or GLUE POWERSHELL jobs. This allows for remote code execution on the executor host, as well as the ability to stop and delete jobs.

Recommendations Update Dromara Skyeye to a version including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.