xxl-job CVE-2026-7306

Q: What is the CVSS score of CVE-2026-7306?

CVE-2026-7306 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26150 LOW

Key Management Errors (CWE-320)

2026-04-28 cna@vuldb.com

Information Disclosure Java

2.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Network-reachable endpoint (AV:N) but high complexity (AC:H) since exploitation requires the default token to remain unconfigured; PR:N because the hard-coded token itself is the bypass credential, not attacker-held privileges.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:08 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.3 (MEDIUM) 2.9 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 22:22 euvd

EUVD-2026-26150

CVE Published

Apr 28, 2026 - 22:16 nvd

LOW 2.9

DescriptionCVE.org

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.

AnalysisAI

Hard-coded cryptographic key exposure in Xuxueli xxl-job's OpenAPI endpoint (versions 3.3.0-3.3.2) allows remote attackers to authenticate to the admin scheduling API using a known default token (default_token) without supplying legitimate credentials. A proof-of-concept exploit has been publicly disclosed via the upstream GitHub issue tracker (SSVC: poc), though CVSS AC:H and SSVC's non-automatable rating indicate mass exploitation is constrained - only deployments retaining the default token configuration are exposed. No confirmed active exploitation (not in CISA KEV) and a low EPSS of 0.04% (14th percentile) suggest targeted rather than opportunistic risk.

Technical ContextAI

xxl-job is an open-source distributed job scheduling framework written in Java, widely used for managing cron-like task execution across executor nodes in enterprise environments. The admin module (xxl-job-admin) exposes a REST API via OpenApiController.java for programmatic job management. CWE-320 (Key Management Errors) covers the root cause: the application ships with a hard-coded or predictable default authentication token (default_token) for the OpenAPI endpoint. If operators do not override the xxl.job.accessToken property in their deployment configuration, the default token - which is derivable from the public source code or disclosed via the GitHub issue at https://github.com/xuxueli/xxl-job/issues/3938 - functions as a valid shared secret for any caller. Affected versions are xxl-job 3.3.0, 3.3.1, and 3.3.2 per EUVD-2026-26150; no NVD CPE string was provided in the available intelligence.

RemediationAI

No vendor-released patch with a confirmed fixed version number is present in the available reference data - the upstream issue at https://github.com/xuxueli/xxl-job/issues/3938 and the associated comment at https://github.com/xuxueli/xxl-job/issues/3938#issuecomment-4149938881 should be monitored for an official fix release; patch status is unconfirmed as of this analysis. The most effective immediate compensating control is to override the default token: set a strong, randomly generated string for the xxl.job.accessToken property in application.properties on all xxl-job-admin instances - any deployment with a non-default token is not exploitable via this specific bypass. Additionally, restrict network access to the xxl-job-admin OpenAPI endpoint using firewall rules or a reverse proxy with enforced authentication, accepting the trade-off of reduced external API accessibility. Do not expose the xxl-job-admin interface to untrusted or public networks. Audit all existing deployments to confirm the access token is not set to the default value, and rotate tokens on any instance where the original configuration state is uncertain.