CVE-2026-107779criticalCWE-306

CVE-2026-107779: falha crítica em dromara skyeye

Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar skyeye

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.5%
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dromara · skyeye
CVEs relacionadas — dromara skyeye

No mesmo produto, das mais perigosas para as menos.

CVE-2026-107780CRITICALDromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterEPSS 2.1%CVE-2026-110609HIGHDromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword ParameterEPSS 0.5%CVE-2026-107781CRITICALDromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileByIdEPSS 0.3%