CVE-2026-26718
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was found in xxl-job-admin web application version 3.0.0. The lack of CSRF token validation and acceptance of arbitrary HTTP methods in the endpoint allow an attacker to make unauthorized modifications to Glue IDE shell scripts.
Risk Assessment
An attacker can exploit this vulnerability to remotely perform unauthorized changes to shell scripts, potentially leading to malicious code execution, privilege escalation, or system integrity compromise.
Recommendation
Immediately update xxl-job-admin to the latest version, implement CSRF token validation for all sensitive endpoints, and restrict accepted HTTP methods to the necessary minimum.
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping