External risk intelligence

Dromara Skyeye Missing Authentication Allows Job Manipulation and Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107779

The vulnerability exists in xxl-job-admin, a centralized task scheduling and management console. Such administrative management interfaces are commonly deployed as web-based services accessible over the network to manage distributed executors. Given the nature of the application as a management portal, it is likely to be reachable in many deployment environments, even if intended for internal use.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Dromara Skyeye, a system for managing jobs, by allowing unauthenticated attackers to execute commands on the host or manipulate jobs. This could potentially lead to unauthorized control over the affected systems.

Attackers can run commands without logging in.
It affects a job management system, potentially impacting operations.
Confirm if this job management system is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted POST request to the JobInfoController endpoints. These endpoints, which manage job information, lack proper authentication checks, allowing unauthenticated users to execute arbitrary commands on the executor host or manipulate existing jobs.

Unauthenticated network access is required.
Attacker sends POST request to job endpoints.
Remote command execution or job manipulation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could exploit a missing authentication vulnerability in Dromara Skyeye's JobInfoController endpoints. This could allow them to execute arbitrary commands on the executor host, or to stop and delete existing jobs.

Commands on executor host.
Via unauthenticated POST requests.
Unauthorized job management actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dromara Skyeye's xxl-job-admin component presents a critical risk due to its network-accessible, unauthenticated nature. The immediate priority is for infrastructure and platform teams to identify all instances of this software, confirm their exposure, and determine business criticality. Security teams should then coordinate with application owners and potentially vendor management to prioritize and execute remediation, considering planned maintenance windows and temporary risk-reduction measures if necessary.

Infrastructure and platform teams own the issue.
Verify technology exposure and criticality first.
Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dromara Skyeye and how is it used?

Dromara Skyeye is a platform that integrates various management tools, including the xxl-job-admin component. This specific component serves as a centralized console for scheduling, monitoring, and managing distributed background tasks or jobs across a network of executor machines.

What does CWE-306 mean for CVE-2026-107779?

CWE-306 represents a 'Missing Authentication for Critical Function' weakness. In this CVE, it means the application fails to verify who is sending requests to specific administrative endpoints. Because these endpoints lack security checks, unauthorized users can issue commands as if they were legitimate administrators.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted POST request to the affected JobInfoController endpoints. It is important to note that simply visiting the management interface page is not enough; the attacker must specifically target the underlying job creation and management functions to execute unauthorized code or delete jobs.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because xxl-job-admin is a management portal designed for network communication. Even if intended only for internal administrative tasks, these consoles are frequently reachable over the network, increasing the chance an attacker could reach the vulnerable endpoints.

What should I do if I run Dromara Skyeye?

First, locate every instance of Dromara Skyeye within your infrastructure. Once identified, work with your application and platform teams to evaluate the business criticality of each instance. Prioritize restricting network access to these consoles while you coordinate with internal stakeholders to apply available updates or implement temporary mitigations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.