Dromara Skyeye Exposes Servers to Critical 9.3 Script Injection Without Vendor Patch

Dromara Skyeye, an open-source monitoring platform, contains a critical security flaw that allows anyone on the internet to run commands on servers using the software. The issue stems from a missing authentication check in a bundled component called xxl-job-admin. Because the system does not require a password or login token for specific actions, attackers can bypass security controls entirely.

In plain English

Think of Dromara Skyeye as a dashboard that helps IT teams watch over their computer systems. Inside this dashboard is a tool designed to schedule and run automated tasks, such as cleaning up old files or updating data. This tool is called xxl-job-admin.

Normally, before you can ask this tool to run a task, the system should ask for your username and password to prove you are authorized. In this version of Skyeye, that safety check is missing for certain endpoints. An attacker does not need to steal a password or hack an account. They can simply send a message to the server asking it to run a script. The server, trusting that the request is legitimate because it lacks an authentication gate, executes the command.

The flaw allows attackers to submit jobs written in Shell, Python, or PowerShell. This means they can run almost any command the server’s operating system understands. They can install malicious software, steal data, or disrupt services by stopping and deleting existing jobs.

The background

The vulnerability is tracked as CVE-2026-107779. According to the National Vulnerability Database, it affects Dromara Skyeye versions up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. The issue is classified under CWE-306, which refers to missing authentication for a critical function.

The specific technical cause lies in the `JobInfoController` endpoints within the bundled `xxl-job-admin`. These endpoints are annotated with `@PermissionLimit(limit = false)`, which effectively disables permission checks. An unauthenticated attacker can send a POST request to the `/jobinfo/addAndStart` endpoint. By including their own code in the `glueSource` parameter, they can create and immediately execute jobs. This gives them the ability to run commands on the executor host or manipulate the job schedule.

What changes now

Security teams using Dromara Skyeye need to verify if their installations are exposed. Since the vulnerability allows remote code execution without any credentials, any instance reachable from the internet is at immediate risk. There is no confirmed patch or update available from the vendor yet. Organizations must assume their systems are vulnerable if they are running affected versions.

What to do and how to stay safe: Dromara Skyeye

• Check if your Dromara Skyeye installation is accessible from the public internet and restrict access using firewalls or network segmentation.
• Monitor server logs for unexpected job creations or executions from unknown IP addresses, particularly those involving Shell, Python, or PowerShell scripts.
• Review the commit history of your Skyeye installation to see if it includes fixes after commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
• Once the vendor provides an update, apply it immediately to restore proper authentication controls on the admin endpoints.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107779?

It is a critical vulnerability in Dromara Skyeye that allows unauthenticated remote code execution due to missing authentication in the xxl-job-admin component.

Which versions of Dromara Skyeye are affected?

All versions up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 are affected.

Is there a patch available?

No, the source material does not indicate that a patch or fix has been released by the vendor yet.