Dromara Skyeye Critical Flaw Allows Unauthenticated Remote Code Execution

A critical security vulnerability in Dromara Skyeye allows unauthenticated attackers to execute arbitrary commands on vulnerable systems. The flaw, tracked as CVE-2026-107779, has been assigned a CVSS score of 9.3, classifying it as Critical according to the National Vulnerability Database. The issue stems from missing authentication controls in specific administrative endpoints within the application’s bundled task scheduler component.

The vulnerability resides in the `JobInfoController` endpoints of the bundled `xxl-job-admin` module. Specifically, endpoints annotated with `@PermissionLimit(limit = false)` fail to enforce proper access controls. This configuration error permits any remote user to interact with these endpoints without providing credentials. According to the NVD record, an attacker can exploit this by sending a POST request to the `/jobinfo/addAndStart` path.

By supplying attacker-controlled data in the `glueSource` field, the attacker can create and immediately execute jobs using `GLUE_SHELL`, `GLUE_PYTHON`, or `GLUE_POWERSHELL` types. This effectively grants the attacker remote code execution capabilities on the executor host. Beyond command execution, the flaw also allows unauthorized users to stop or delete existing jobs, potentially disrupting scheduled operations.

Context and Background

The weakness is categorized under CWE-306, which refers to missing authentication for a critical function. This type of vulnerability is particularly dangerous because it requires no prior access or valid session tokens to exploit. The flaw affects Dromara Skyeye versions up to and including commit `003549ae5615bd114ba5bb8ddf6a8e8ead97c321`. The National Vulnerability Database lists the specific commit hash as the boundary for affected software, indicating that versions prior to this point in the repository history are vulnerable.

The exposure of administrative interfaces to the public internet without authentication is a common source of high-severity incidents in web applications. The `xxl-job-admin` component, which is bundled with Skyeye, is designed for distributed task scheduling, but its insecure configuration in this version undermines the security of the entire platform.

Who is Affected

Organizations using Dromara Skyeye are at risk if they have not updated to a version beyond commit `003549ae5615bd114ba5bb8ddf6a8e8ead97c321`. Any instance where the bundled `xxl-job-admin` service is exposed to untrusted networks is susceptible to exploitation. The vulnerability allows for complete compromise of the host system through remote code execution, making it a high-priority issue for security teams.

Since no fix has been confirmed in the provided source material, administrators must verify their current version status immediately. The impact is severe, as attackers can take full control of the server where the executor runs, potentially moving laterally within the network or exfiltrating data.

What should you do?

Security teams should assess their exposure to this vulnerability by checking the version of Dromara Skyeye currently in use. If the installation is at or before the affected commit, the system is vulnerable. Organizations should restrict network access to the `xxl-job-admin` endpoints, ensuring they are not accessible from untrusted networks. Monitoring logs for unauthorized job creation or unusual POST requests to `/jobinfo/addAndStart` can help detect active exploitation. Until a vendor update is available, consider isolating the affected services or implementing strict firewall rules to block external access to the application’s administrative interfaces.