# CVE-2026-106708: XXL-JOB cross-site request forgery in user management

Source: https://junglewise.ai/threats/cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106708 · Severity: high · CVSS 8.8 · Published 2026-10-15

XXL-JOB is a distributed task scheduling framework used to manage and execute jobs across multiple machines. A cross-site request forgery vulnerability in the user management endpoints allows an attacker to create administrator accounts or modify user settings when a logged-in administrator visits attacker-controlled content. An attacker can gain full administrative control of the job scheduling platform without the administrator's knowledge.

Vendors: [Xuxueli](https://junglewise.ai/threats/vendors/xuxueli).

## Quick answers

**Is CVE-2026-106708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106708 being exploited in the wild.

**How severe is CVE-2026-106708?** High severity, with a CVSS score of 8.8, published 15 October 2026.

**Which products and versions are affected?** Xuxueli XXL-JOB 3.5.0-SNAPSHOT and earlier.

**Is there a fix for CVE-2026-106708?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-106708 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106708?** Check whether you run Xuxueli XXL-JOB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSRF weakness in JobUserController endpoints (/user/insert, /user/update, /user/delete) that lack CSRF token validation and do not restrict HTTP methods. An unauthenticated attacker can craft a malicious GET request targeting a logged-in administrator's session to create new admin accounts with attacker-controlled credentials. The attack requires user interaction (administrator visiting the attacker's site) but no other preconditions.

## Affected products

- Xuxueli XXL-JOB 3.5.0-SNAPSHOT and earlier

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md](https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md)
- [https://github.com/xuxueli/xxl-job](https://github.com/xuxueli/xxl-job)

## Related threats

- [XXL-JOB stored XSS in job code editor](https://junglewise.ai/threats/cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross)