Hard-Coded Cryptographic Key in xxl-job OpenAPI Endpoint

Publication date: 2026-04-28

Last updated on: 2026-04-29

Assigner: VulDB

Description

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-28

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-7306

Affected Vendors & Products

Vendor	Product	Version / Range
xuxueli	xxl-job	to 3.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-320	Key Management Errors
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Xuxueli xxl-job up to version 3.3.2, specifically in an unknown function within the OpenAPI Endpoint component of the file OpenApiController.java. The issue arises from manipulation of the argument named default_token, which leads to the use of a hard-coded cryptographic key. This flaw can be exploited remotely, but the attack requires a high level of complexity and is considered difficult to execute. The exploit has been publicly disclosed and may be used by attackers.

Impact Analysis

Exploitation of this vulnerability can lead to the compromise of confidentiality, integrity, and availability of the affected system. Since it involves the use of a hard-coded cryptographic key, attackers might bypass security controls or gain unauthorized access remotely. However, due to the high complexity and difficulty of the attack, the risk is moderate.

Hi! I’m here to help you understand CVE-2026-7306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70