Description

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-12T23:17:01.307Z",
  "pubdate": "2026-09-12T23:17:01.307Z",
  "executiveSummary": "A critical vulnerability exists in xxl-job up to version 3.4.2, specifically within the JobGroupController component, resulting in improper privilege management.\nThis flaw allows remote, unauthenticated, or unauthorized actors to manipulate administrative functionality, potentially leading to unauthorized control over job execution groups.\nThe vulnerability represents a significant security risk, as the exploit is publicly available and the vendor has not provided a responsive resolution or patch.\nThe scope of the issue centers on the lack of sufficient access control enforcement when interacting with the JobGroup management API, enabling malicious users to bypass security boundaries.\nThe impact includes the potential for unauthorized modification of system configurations, which could lead to arbitrary job execution or denial of service through manipulation of administrative resources.\nGiven the public availability of the exploit code, organizations running affected versions of xxl-job are at heightened risk of compromise and should prioritize defensive configurations or internal network isolation.",
  "technicalDetails": "The vulnerability resides in the xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java file. The root cause is improper implementation of access control checks on administrative API endpoints exposed by the JobGroupController class.\nWithin the XXL-JOB architecture, JobGroupController is responsible for managing the registry of job executors. The flaw manifests because the controller fails to properly validate the authorization context of the requesting user when performing CRUD (Create, Read, Update, Delete) operations on job groups.\nThe attack flow initiates with a remote attacker sending crafted HTTP requests to the vulnerable endpoint mapped to the JobGroupController. Because the application lacks robust server-side privilege validation, the controller executes the requested administrative actions as if the requester possessed sufficient administrative privileges.\nBy manipulating parameters within these requests, an attacker can modify existing job group definitions, potentially reassigning job executors to malicious or unauthorized endpoints, or creating new groups to facilitate lateral movement or persistence within the task scheduling infrastructure.\nSince the exploit is publicly available, the barrier to entry for attackers is low. The attack does not necessarily require complex reconnaissance; the attacker simply interacts with the exposed management interface using standard protocols (HTTP/HTTPS).\nPost-exploitation, the impact is severe. An attacker could redirect job execution tasks to unauthorized external infrastructure or disable critical business workflows managed by the job executor. Furthermore, since xxl-job often manages high-privilege automation tasks, manipulating these job groups provides a path to secondary exploitation of the downstream executors connected to the admin console.\nThe affected versions are all releases of xxl-job up to and including 3.4.2. The vulnerability is present in the administrative interface, making any instance exposed to untrusted networks (including internal networks with insufficient segmentation) highly susceptible to exploitation. The lack of vendor response suggests that users must rely on compensating security controls rather than official patch management."
}