CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-107779 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains ...

·Source: NIST NVD

Updated:

Executive Summary

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor ho

Analysis

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs. CVSS Score: 9.8. Published: 2026-10-08T21:17:52.790.

Indicators of Compromise (2)

SHA-1 (1)
003549ae5615bd114ba5bb8ddf6a8e8ead97c321
VirusTotalAnyRunJoe Sandbox
CVE (1)
CVE-2026-107779
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Cryptohack Roundup: Turkey Holds Hex Founder, Seizes $7.15M

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-turkey-detains-hex-founder-seizes-715m-image_small-7-a-33174.jpg" align=right hspace=4><b>Also: Fake Ngrave Alerts Linked to $2.65M Crypto Theft</b><br>This week, Turkish police detained Hex founder Richard Heart, attackers exploited Cysic's bridge to mint unauthorized tokens, fake Ngrave alerts led to $2.65 mil

Bank Info Security
MEDIUMVulnerability

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called

The Hacker News
MEDIUMVulnerability

How PHP's Coordinated Disclosure Process Went Belly Up

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/how-phps-coordinated-disclosure-process-went-belly-up-image_small-7-a-33176.jpg" align=right hspace=4><b>Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024</b><br>The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn't. A demonstration video of a

Bank Info Security