Dromara Skyeye: Missing authentication in bundled xxl-job-admin allows remote code execution

Summary

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 bundles xxl-job-admin, whose JobInfoController endpoints are marked as not requiring authentication. An unauthenticated attacker with network access to the admin interface can create GLUE_SHELL, GLUE_PYTHON or GLUE_POWERSHELL jobs with attacker-supplied code, which execute commands on the executor host. The attacker can also stop and delete existing jobs.

Affected

• Dromara Skyeye up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 (default branch)
• Bundled xxl-job-admin 2.3.0 component in the affected commit
• No release tags are named in the sources.

Fixed in

Unknown.

• No fixed commit, release or vendor advisory was found at the time of research.

Workaround

• Restrict network access to the Skyeye admin interface to trusted internal IP addresses or a VPN.
• Remove the @PermissionLimit(limit = false) annotation on the JobInfoController endpoints so that authentication applies. This is a third-party suggestion and requires a code change; it is not a vendor-confirmed fix.
• Restrict network access from the xxl-job executor host, as command execution happens there.

Exploitation

• In the wild: No evidence found. No CISA KEV listing was found.
• Public information: The flaw is described in public Skyeye GitHub issue #29.
• Public proof of concept: Unknown.
• CISA SSVC: Automatable yes, technical impact total, exploitation none.
• EPSS: about 0.5 percent according to two aggregators.

Our recommendation

• Inventory all Skyeye deployments, including instances where xxl-job is bundled and not obvious.
• Remove public exposure of the Skyeye admin panel now and limit access to trusted IP addresses or VPN.
• Assume no patch exists until the maintainer confirms one; monitor issue #29 and the upstream repository.
• Review executor and job logs for unexpected GLUE jobs if the instance was reachable.
• Treat the whole Skyeye instance as affected, as related issues CVE-2026-107780 and CVE-2026-107781 are also reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-107779 VulnCheck advisory www.vulncheck.com
• Skyeye GitHub issue #29 github.com
• Skyeye repository github.com
• Affected code at commit 003549ae github.com
• Positive Technologies PT-2026-108202 vulners.com
• OSV CVE-2026-107779 osv.dev
• VulDB CVE-2026-107779 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:53.