CVE-2026-107779 dromara CVE debrief

Who should care

Defenders responsible for Dromara Skyeye deployments, particularly those using xxl-job-admin, should assess exposure and prioritize remediation due to the critical severity and potential for unauthenticated command execution.

Why it matters

CVE-2026-107779 is a critical vulnerability in Dromara Skyeye's xxl-job-admin component, allowing unauthenticated attackers to potentially execute commands on executor hosts. Defenders should prioritize verifying exposure, assessing impact, and applying remediation due to the high severity and potential for disruption.

• Potential unauthenticated command execution on executor hosts
• Possible disruption of job execution or deletion
• Need for verification of affected versions and exposure
• Priority for applying vendor remediation or compensating controls

Technical summary

Dromara Skyeye's xxl-job-admin component contains a missing authentication vulnerability in JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, potentially executing commands on the executor host or stopping and deleting jobs. This vulnerability allows attackers to execute commands on executor hosts without proper authentication, posing a significant risk to Dromara Skyeye deployments. Defenders should assess the impact of potential command execution and apply vendor remediation or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of Dromara Skyeye deployments to unauthenticated job endpoint attacks, assessing the impact of potential command execution, and applying vendor remediation.

Recommended defensive actions

• Verify Dromara Skyeye deployments for exposure to unauthenticated job endpoints
• Assess the impact of potential command execution on executor hosts
• Apply vendor remediation or compensating controls to restrict access to job endpoints
• Monitor for suspicious job creation or execution activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item indicate a critical vulnerability in Dromara Skyeye's xxl-job-admin component, allowing unauthenticated attackers to execute commands on the executor host. However, details on affected versions, exploitation, and victim impact are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.