CVE-2026-52371 Overview
CVE-2026-52371 is a Server-Side Request Forgery (SSRF) vulnerability in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0. xxl-job is a widely deployed distributed task scheduling platform used in enterprise Java environments. Authenticated attackers can supply a crafted HTTP request to the trigger endpoint and force the xxl-job admin server to send outbound requests to arbitrary internal or external resources. This behavior enables internal network reconnaissance, port scanning, and interaction with services that are otherwise unreachable from the internet.
Critical Impact
Authenticated attackers can leverage the xxl-job admin server to scan internal infrastructure and reach protected services behind the network perimeter [CWE-918].
Affected Products
- xxl-job v3.4.0
- xxl-job-admin component (/jobinfo/trigger endpoint)
- Deployments using the affected release for distributed task scheduling
Discovery Timeline
- 2026-07-31 - CVE-2026-52371 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-52371
Vulnerability Analysis
The vulnerability resides in the xxl-job-admin/jobinfo/trigger component. This endpoint accepts parameters that influence outbound HTTP requests made by the admin server. Because the target URL or host parameters are not restricted against internal address ranges, an authenticated user can direct the server to issue arbitrary requests. Attackers use the resulting responses and timing behavior to enumerate live hosts, discover open ports, and identify internal services.
Exploitation requires valid credentials on the xxl-job admin console, which limits opportunistic abuse. However, in environments where default credentials remain in place or where low-privilege accounts exist, the barrier is minimal. The scheduler often runs with network reachability to backend databases, cloud metadata services, and other management planes, amplifying the impact of a successful SSRF.
Root Cause
The root cause is insufficient validation of user-supplied input that ultimately controls the destination of a server-initiated HTTP request. The trigger handler does not enforce an allowlist of destinations, does not block loopback or private address ranges, and does not restrict URL schemes. This matches the pattern described in CWE-918: Server-Side Request Forgery.
Attack Vector
An authenticated attacker sends a crafted HTTP request to the /jobinfo/trigger endpoint on the xxl-job admin server. The request includes parameters that steer the outbound connection toward an internal target. The attacker observes response codes, response bodies, and latency to infer the state of the target service. Repeating the request across ranges of IPs and ports yields a map of the internal network. Full technical details and reproduction steps are documented in the xxl-job SSRF PoC repository.
Detection Methods for CVE-2026-52371
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the xxl-job admin server toward internal RFC1918 address ranges or cloud metadata endpoints such as 169.254.169.254.
- High-volume or sequential requests to /jobinfo/trigger from a single authenticated session.
- Admin server logs showing trigger invocations with unusual target parameters that do not correspond to registered executors.
Detection Strategies
- Inspect web access logs for POST requests to xxl-job-admin/jobinfo/trigger and correlate them with subsequent outbound connections from the host.
- Alert on connections from the xxl-job admin process to hosts or ports outside the documented executor inventory.
- Baseline normal trigger activity per user account and flag deviations in target diversity or request frequency.
Monitoring Recommendations
- Forward xxl-job admin logs and host network telemetry to a centralized analytics platform for correlation.
- Monitor egress traffic from the scheduler host with DNS and flow logging to catch scanning behavior early.
- Track authentication events on the xxl-job admin console and review low-privilege account usage of the trigger endpoint.
How to Mitigate CVE-2026-52371
Immediate Actions Required
- Restrict network egress from the xxl-job admin server to the specific executor hosts and ports it must reach.
- Rotate credentials for all xxl-job admin accounts and remove unused or default accounts.
- Place the xxl-job admin console behind authenticated access controls such as a VPN or reverse proxy with MFA.
- Review recent admin logs for suspicious trigger invocations against non-executor destinations.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Track the xxl-job project releases and upgrade beyond v3.4.0 once a fixed version is available. Review the PoC repository for reproduction context when validating mitigations.
Workarounds
- Apply host-based firewall rules that deny outbound connections from the admin server to internal management networks and cloud metadata endpoints.
- Enforce least-privilege roles on the xxl-job admin console so that only trusted operators can invoke trigger actions.
- Add a reverse proxy in front of /jobinfo/trigger to validate parameters and drop requests targeting non-approved destinations.
# Example iptables rules restricting egress from the xxl-job admin host
# Allow traffic only to known executor subnet 10.10.20.0/24 on port 9999
iptables -A OUTPUT -p tcp -d 10.10.20.0/24 --dport 9999 -j ACCEPT
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
