CVE-2026-7303: Xuxueli xxl-job RCE Vulnerability

CVE-2026-7303 Overview

A security vulnerability has been discovered in Xuxueli xxl-job, a distributed task scheduling platform, affecting versions up to 3.3.2. The flaw resides in the logDetailCat function within the Execution Log Handler component, specifically in the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java. This vulnerability allows for improper control of resource identifiers through manipulation of the logId argument, potentially enabling unauthorized access to execution log data.

Critical Impact

Remote attackers can exploit improper resource identifier control in the Execution Log Handler to potentially access unauthorized log data, though exploitation complexity is high.

Affected Products

• Xuxueli xxl-job versions up to 3.3.2
• xxl-job-admin component (JobLogController.java)
• Execution Log Handler functionality

Discovery Timeline

• 2026-04-28 - CVE-2026-7303 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7303

Vulnerability Analysis

This vulnerability is classified as CWE-99 (Improper Control of Resource Identifiers), which occurs when an application constructs a resource identifier using external input without adequately neutralizing special elements that could modify the intended identifier. In the context of xxl-job, the logDetailCat function in the JobLogController.java file fails to properly validate and sanitize the logId parameter before using it to retrieve execution log data.

The attack can be performed remotely over the network, though the exploitation complexity is characterized as high, making successful attacks more difficult to execute. The vulnerability has been publicly disclosed and exploit information is available, which increases the urgency for organizations running affected versions to apply patches.

Root Cause

The root cause lies in insufficient input validation and access control within the Execution Log Handler component. When processing requests to retrieve log details, the application does not adequately verify that the requesting user has proper authorization to access the specified log resource identified by the logId parameter. This allows potential manipulation of resource identifiers to access logs that should be restricted.

The vulnerable code path allows the jobGroup parameter to be bypassed in certain conditions, as shown in the patched MyBatis mapper configuration where the conditional logic was corrected.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring prior authentication in certain configurations. An attacker could manipulate the logId parameter in HTTP requests to the affected endpoint to potentially enumerate or access execution logs belonging to different job groups or jobs they should not have access to.

The following code shows the security patch applied in the MyBatis mapper (XxlJobLogMapper.xml):

 	SELECT <include refid="Base_Column_List" />
 	FROM xxl_job_log AS t
 	<trim prefix="WHERE" prefixOverrides="AND | OR" >
-		<if test="jobId==0 and jobGroup gt 0">
+		<if test="jobGroup gt 0">
 			AND t.job_group = #{jobGroup}
 		</if>
 		<if test="jobId gt 0">

Source: GitHub Commit Details

The patch modifies the conditional logic to ensure proper filtering by jobGroup regardless of whether jobId is set to zero, preventing the bypass of group-level access controls.

Detection Methods for CVE-2026-7303

Indicators of Compromise

• Unusual or repeated requests to the log detail endpoint with varying logId parameters
• Access attempts to execution logs from unauthorized IP addresses or user sessions
• Patterns of sequential logId enumeration in application access logs
• Requests with jobId=0 combined with attempts to access logs from different job groups

Detection Strategies

• Implement application-level logging to track all requests to the logDetailCat endpoint
• Monitor for anomalous patterns in log access requests, particularly bulk enumeration attempts
• Deploy web application firewall (WAF) rules to detect and block suspicious parameter manipulation
• Review audit logs for access to execution logs by users without proper job group permissions

Monitoring Recommendations

• Enable detailed access logging for the xxl-job-admin component
• Set up alerts for high-frequency requests to log-related endpoints from single sources
• Monitor for error responses that may indicate access control violations
• Implement rate limiting on log retrieval endpoints to slow potential enumeration attacks

How to Mitigate CVE-2026-7303

Immediate Actions Required

• Upgrade xxl-job to version 3.4.0 or later which contains the security fix
• Review application logs for any signs of exploitation attempts
• Implement network-level access controls to restrict access to the xxl-job-admin interface
• Consider temporarily disabling external access to the admin interface until patching is complete

Patch Information

The vulnerability has been addressed in xxl-job version 3.4.0. The fix is identified by commit hash d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. Organizations should upgrade to the patched version as soon as possible. For more information, see the GitHub Release Information and the GitHub Issue Discussion.

Workarounds

• Restrict network access to the xxl-job-admin interface to trusted networks only
• Implement additional authentication layers (reverse proxy with authentication) in front of the admin interface
• Use firewall rules to limit which IP addresses can access the admin panel
• Enable strict access controls and review user permissions for log access

# Example: Restrict access to xxl-job-admin using iptables
iptables -A INPUT -p tcp --dport 8080 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP