CVE-2026-107779: Missing Authentication for Critical Function in dromara skyeye

CVE-2026-107779 describes a missing authentication vulnerability in Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. The vulnerability exists in bundled xxl-job-admin JobInfoController endpoints that are annotated with @PermissionLimit(limit = false), which disables permission checks. This allows unauthenticated attackers to POST jobs with attacker-supplied glueSource code (in shell, Python, or PowerShell) to the /jobinfo/addAndStart endpoint. Successful exploitation can lead to arbitrary command execution on the executor host or the ability to stop and delete jobs.

The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the executor host by submitting malicious job definitions. This can lead to full system compromise, disruption of job scheduling, and potential deletion of legitimate jobs. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints and consider implementing external authentication or network-level controls to prevent unauthenticated access to the /jobinfo/addAndStart endpoint.