CVE-2026-26718: xxl-job-admin CSRF Vulnerability

CVE-2026-26718 Overview

CVE-2026-26718 is a Cross-Site Request Forgery (CSRF) vulnerability in the xxl-job-admin web application version 3.0.0. The affected Glue IDE endpoint accepts arbitrary HTTP methods through a permissive request mapping and does not validate CSRF tokens. An attacker who tricks an authenticated administrator into visiting a malicious page can modify Glue IDE shell scripts without consent. Because Glue IDE scripts execute on scheduled job executors, unauthorized modification can lead to arbitrary command execution on downstream worker nodes.

Critical Impact
Attackers can silently overwrite Glue IDE shell scripts through an authenticated administrator's browser, enabling arbitrary command execution on xxl-job executor nodes.

Affected Products

xxl-job-admin version 3.0.0
Deployments exposing the Glue IDE script management endpoint
Environments where administrators authenticate via browser sessions

Discovery Timeline

2026-07-15 - CVE-2026-26718 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-26718

Vulnerability Analysis

The vulnerability resides in the Glue IDE script update endpoint of xxl-job-admin v3.0.0. The controller method uses a permissive Spring @RequestMapping annotation that does not restrict HTTP methods to POST. As a result, the endpoint accepts GET, POST, and other verbs interchangeably, which enables cross-origin request smuggling through simple HTML tags such as <img> or auto-submitted forms.

The application does not issue or verify a per-session anti-CSRF token on state-changing requests. Combined with session cookies that lack a strict SameSite attribute, an attacker-hosted page can trigger authenticated requests from a victim administrator's browser. The forged request updates the stored Glue script, which the executor later runs during scheduled task dispatch.

Root Cause

The root cause is missing CSRF protection combined with overly permissive request mapping. The endpoint modifies server-side state, specifically the Glue script content persisted for scheduled jobs, without validating the origin or authenticity of the request. This aligns with [CWE-352: Cross-Site Request Forgery].

Attack Vector

An attacker crafts a malicious HTML page containing a form or resource request that targets the Glue script update endpoint on the victim's xxl-job-admin instance. When an authenticated administrator visits the attacker-controlled page, the browser attaches session cookies and submits the request. The server processes the modification because it cannot distinguish forged requests from legitimate ones. Because Glue IDE supports shell script types, the injected script executes on the next scheduled trigger, granting the attacker code execution on executor infrastructure. Proof-of-concept material is documented in the GitHub PoC Repository.

Detection Methods for CVE-2026-26718

Indicators of Compromise

Unexpected modifications to Glue IDE script content, especially shell-type scripts, without a corresponding change ticket.
HTTP requests to the Glue script update endpoint originating from Referer headers outside the trusted admin domain.
Executor logs showing shell commands that deviate from established job baselines.

Detection Strategies

Monitor xxl-job-admin access logs for state-changing requests served over GET or with cross-origin Referer and Origin headers.
Enable database audit logging on the xxl_job_info table and alert on updates to the glue_source column outside change windows.
Compare Glue script content against a signed baseline and flag drift.

Monitoring Recommendations

Alert on outbound network connections or process spawns from executor nodes that do not match approved job definitions.
Correlate administrator session activity with script modification events to identify requests issued without direct UI interaction.
Track authentication events and cross-reference them with script edits performed within the same session token.

How to Mitigate CVE-2026-26718

Immediate Actions Required

Restrict access to xxl-job-admin to trusted management networks and require VPN or bastion access.
Enforce short session timeouts and require re-authentication before Glue script modifications.
Review all Glue IDE scripts for unauthorized modifications and restore known-good versions from source control.

Patch Information

At the time of publication, the xxl-job-admin project had not published a fixed release referenced in the NVD entry. Monitor the XXL Job Admin Site and the project's release channel for a version that introduces CSRF token validation and constrains HTTP methods on script management endpoints.

Workarounds

Configure a reverse proxy to reject requests to xxl-job-admin endpoints that use methods other than POST for state-changing operations.
Set session cookies with SameSite=Strict and Secure attributes to block cross-site cookie transmission.
Deploy a web application firewall rule that blocks requests to /jobcode/save and related endpoints when the Origin or Referer header does not match the admin domain.
Segment executor nodes from sensitive infrastructure so that compromised Glue scripts have limited blast radius.

bash

# Example nginx snippet enforcing SameSite cookies and origin checks
proxy_cookie_flags ~ samesite=strict secure;
if ($http_origin !~* ^https://xxljob\.internal\.example\.com$) {
    return 403;
}
if ($request_method !~ ^(POST)$) {
    return 405;
}