# CVE-2026-107779: Dromara Skyeye xxl-job-admin authentication bypass in JobInfoController

Source: https://junglewise.ai/threats/cve-2026-107779-dromara-skyeye-through-commit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107779 · Severity: critical · CVSS 9.8 · Published 2026-10-08

Dromara Skyeye is an enterprise management and workflow platform. The bundled job scheduler (xxl-job-admin) has endpoints that accept job creation requests without authentication, allowing attackers to execute arbitrary commands on worker machines or disrupt scheduled jobs by deploying malicious shell, Python, or PowerShell scripts.

Technologies: [Dromara Skyeye](https://junglewise.ai/threats/technologies/skyeye). Vendors: [Dromara](https://junglewise.ai/threats/vendors/dromara).

## Quick answers

**Is CVE-2026-107779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107779 being exploited in the wild.

**How severe is CVE-2026-107779?** Critical severity, with a CVSS score of 9.8, published 8 October 2026.

**Which products and versions are affected?** Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

**Is there a fix for CVE-2026-107779?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107779 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107779?** Check whether you run Dromara Skyeye at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The JobInfoController endpoints annotated with @PermissionLimit(limit = false) lack proper authentication checks, allowing unauthenticated attackers to POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource code to /jobinfo/addAndStart and related endpoints. This results in remote code execution on job executor hosts or allows stopping and deleting jobs via network access without credentials.

## Affected products

- Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

## Timeline

- 2026-10-08: disclosed

## References

- [https://github.com/dromara/skyeye](https://github.com/dromara/skyeye)
- [https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.3.0/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java](https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.3.0/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java)

## Related threats

- [Dromara Skyeye server-side request forgery and authorization bypass](https://junglewise.ai/threats/cve-2026-107781-dromara-skyeye-through-commit)
- [Dromara Skyeye OS command injection in TTS endpoint](https://junglewise.ai/threats/cve-2026-107780-dromara-skyeye-through-commit)