Dromara Skyeye RCE: Unauthenticated Attackers Exploit Job Endpoints in Critical 9.3 Flaw
A critical vulnerability in Dromara Skyeye allows unauthenticated attackers to execute arbitrary code on executor hosts via exposed job scheduling endpoints.
Key points
- The flaw affects Dromara Skyeye versions up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321
- Attackers can post GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs without authentication
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.3
Dromara Skyeye contains a missing authentication vulnerability that permits unauthenticated remote code execution. The flaw exists in bundled xxl-job-admin components and allows attackers to run commands on executor hosts or manipulate job states.
What happened
According to the National Vulnerability Database, Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 suffers from a missing authentication weakness classified as CWE-306. The vulnerability resides in the bundled xxl-job-admin JobInfoController endpoints. Specifically, certain endpoints are annotated with @PermissionLimit(limit = false), which disables authentication checks for those routes.
An unauthenticated attacker can exploit this by sending a POST request to the /jobinfo/addAndStart endpoint. The attacker supplies a job type of GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL along with attacker-controlled code in the glueSource parameter. This action triggers the execution of the supplied script on the executor host. Additionally, the vulnerability allows attackers to stop or delete existing jobs, potentially disrupting legitimate scheduling operations. The National Vulnerability Database assigns a CVSS score of 9.3, rating the severity as critical.
Why it matters
The exposure of administrative endpoints without authentication creates a direct path for remote code execution. Because the flaw affects the job scheduling component, attackers can inject scripts in multiple languages, including shell, Python, and PowerShell. This versatility increases the attack surface, allowing adversaries to choose the most effective payload for the target environment.
The ability to execute commands on the executor host means that compromise of the scheduling service can lead to full control of the underlying infrastructure. Furthermore, the capacity to stop or delete jobs provides attackers with a mechanism for denial-of-service or data destruction within the scheduling pipeline. Software developers relying on Dromara Skyeye for distributed task scheduling must recognize that default configurations may leave these endpoints exposed to the internet or internal networks without sufficient access controls.
What to watch
- Monitor for unauthorized POST requests to /jobinfo/addAndStart
- Check logs for unexpected job creation or deletion events
- Verify that JobInfoController endpoints are not accessible without authentication
- Look for execution of GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs from untrusted sources
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: Dromara Skyeye
- Restrict network access to the xxl-job-admin interface to trusted IP ranges only
- Implement firewall rules to block external traffic to the /jobinfo/addAndStart endpoint
- Audit application configurations to ensure authentication is enforced on all administrative endpoints
- Once the vendor provides an update, apply the patch to version 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 or later
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107779?
The National Vulnerability Database rates CVE-2026-107779 with a CVSS score of 9.3, which is considered critical.
Which versions of Dromara Skyeye are affected?
Versions of Dromara Skyeye up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 are affected.
How can an attacker exploit this vulnerability?
Attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to the /jobinfo/addAndStart endpoint without authentication.
