EUVD-2026-95257
GHSA-2h33-hvx5-jq32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoint intentionally disables auth (PR:N) and is reachable over the network with a simple POST (AV:N/AC:L); arbitrary command execution on the executor yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
AnalysisAI
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable when the bundled xxl-job-admin web console (JobInfoController) is network-reachable and at least one xxl-job executor is registered, because the /jobinfo/addAndStart (and related add/start/stop/delete) endpoints are annotated @PermissionLimit(limit = false), bypassing authentication entirely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the provided intelligence; check the referenced GitHub issue (https://github.com/dromara/skyeye/issues/29) for a fix or commit, and upgrade to a Skyeye release that includes the authentication fix if one becomes available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Dromara Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 that expose the bundled xxl-job-admin console; immediately remove internet or broad network access to that console, place it behind an authenticated reverse proxy or VPN, and review xxl-job job history and logs for suspicious GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skye
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the s
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today