PT-2026-35826 · Xuxueli · Xxl-Job

Larlarua · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7306

Mitre

CVSS v3.1

5.6

Medium

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2026-7306

Affected Products

Xxl-Job

References · 7

• 🔥 https://github.com/xuxueli/xxl-job/issues/3938 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7306 · Security Note
• https://github.com/xuxueli/xxl-job/issues/3938#issuecomment-4149938881 · Note
• https://vuldb.com/vuln/359961/cti · Note
• https://vuldb.com/submit/803077 · Note
• https://vuldb.com/vuln/359961 · Note
• https://github.com/xuxueli/xxl-job · Note