XXL-JOB: Cross-site request forgery in user management

Summary

XXL-JOB 3.5.0-SNAPSHOT and earlier lacks CSRF protection on the user management endpoints /user/insert, /user/update and /user/delete, which also accept any HTTP method. If a logged-in administrator visits a malicious web page, an attacker can create, change or delete users, for example by adding a rogue administrator account. Exploitation requires user interaction by the victim and access to the admin console.

Affected

• XXL-JOB 3.5.0-SNAPSHOT and earlier (per CVE record and reporter; NVD lists no CPE)
• Component: JobUserController (/user/insert, /user/update, /user/delete)

Fixed in

Unknown. No fixed version has been published in the sources reviewed.

Workaround

• Block cross-site requests to /user/insert, /user/update and /user/delete with a web application firewall or reverse proxy, as suggested by a third-party source (not tested).
• Restrict access to the admin console to internal networks or VPN.
• Require SSO/MFA for admin access.
• Admins should log out after use and avoid browsing the web while logged in.

Exploitation

• Public sources disagree. VulDB reports no available exploit; a daily CVE digest references a GitHub PoC (not verified).
• No reports of exploitation in the wild; not listed in CISA KEV according to one source.
• CISA SSVC assessment: exploitation none, not automatable.

Our recommendation

• Check whether the XXL-JOB admin console is reachable from the internet; restrict it if so.
• Apply the reverse-proxy or WAF block on the affected endpoints until a fixed version is available.
• Check the xxl-job GitHub releases and install a fixed version as soon as one is confirmed.
• Review the user list for unexpected or unknown accounts and monitor for new user creation.
• Do not run unverified proof-of-concept code from third-party sites.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-106708 reporter advisory github.com
• XXL-JOB GitHub repository github.com
• OSV / Vulners record vulners.com
• OpenCVE CVE-2026-106708 app.opencve.io
• VulDB 420868 vuldb.com
• Strix CVE-2026-106708 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:32.