EUVD-2026-26149Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network access required (PR:L); SSRF enables limited confidentiality disclosure of internal services; no integrity or availability impact demonstrated in available data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
6DescriptionCVE.org
A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): "Triggers are manually activated and involve login and access control, thus requiring management." The pull request by the researcher got rejected because of that.
AnalysisAI
Server-side request forgery in Xuxueli xxl-job 3.3.0-3.3.2 allows an authenticated admin-panel user to supply arbitrary URLs in the addressList parameter of the manual job trigger endpoint, causing the server to issue outbound HTTP requests to attacker-specified internal or external destinations. The vulnerability is publicly disclosed with exploit code available, but the project maintainer formally disputes its severity, asserting the trigger endpoint is protected by login and role-based access control, and rejected the fix PR. No patched release exists; EPSS at 0.04% and absence from CISA KEV indicate minimal observed in-the-wild exploitation.
Technical ContextAI
xxl-job is a Java-based distributed job scheduling framework widely used in Chinese enterprise environments. The vulnerable code path is in XxlJobServiceImpl.java within the trigger() method, which dispatches jobs to executor nodes. The addressList parameter - intended to allow operators to target specific registered executor addresses - is forwarded to the dispatch mechanism without being validated against the job group's pre-registered executor list. This is a classic CWE-918 (Server-Side Request Forgery) pattern: attacker-controlled input is used as a URL in a server-initiated HTTP request. The proposed fix in PR #3937 implements an allowlist check, loading the job group's registered addresses from the database and rejecting any submitted address not in that set. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L confirms the endpoint is network-accessible with low authentication requirements and no special attack conditions.
RemediationAI
No vendor-released patch exists at time of analysis. The upstream fix PR #3937 (https://github.com/xuxueli/xxl-job/pull/3937) was formally rejected by the project maintainer. Organizations that assess this as a real risk can apply the proposed patch as a local fork: the fix adds allowlist validation of addressList against the job group's pre-registered executor addresses, rejecting any address not explicitly registered in the group. As a compensating control, restrict the xxl-job admin interface to trusted networks or VPN-only access, ensuring only authorized operators can reach the trigger endpoint. In cloud environments, enforce egress filtering on the xxl-job admin container to block outbound connections to the instance metadata service (169.254.169.254) and other internal-only address ranges - note this may affect legitimate executor discovery if executors use overlapping network ranges. Monitor outbound HTTP traffic from the xxl-job admin process for anomalous destinations. Advisory references: https://vuldb.com/vuln/359960 and https://github.com/xuxueli/xxl-job/issues/3935.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today