PT-2026-23938 · Xuxueli · Xxl-Job

Zast.Ai · CVE-2026-3733 · Published 2026-03-08 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions up to 3.3.2

Description A server-side request forgery condition exists in xuxueli xxl-job. The issue is located in the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java, affecting an unknown function. This allows for remote attacks. The project maintainer indicated that access token security verification is required to address the issue.

Recommendations versions prior to 3.3.2 require access token security verification.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3733

Affected Products

Xxl-Job

References · 16

• 🔥 https://github.com/xuxueli/xxl-job/issues/3924#issue-3987941359 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3733.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3733 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3733 · Vendor Advisory
• https://github.com/xuxueli/xxl-job/issues/3924 · Note
• https://twitter.com/cyberbivash/status/2030622694803140628 · Twitter Post
• https://vuldb.com/?submit.767226 · Note
• https://twitter.com/geng_zast/status/2056770373547708847 · Twitter Post
• https://t.me/CVEtracker/46804 · Telegram Post
• https://vuldb.com/?ctiid.349711 · Note
• https://twitter.com/zast_ai/status/2056768861979197753 · Twitter Post
• https://twitter.com/CVEnew/status/2030747862699819373 · Twitter Post
• https://vuldb.com/?id.349711 · Note
• https://github.com/xuxueli/xxl-job · Note
• https://twitter.com/VulmonFeeds/status/2030616380463071550 · Twitter Post