CVE-2026-7306
Received Received - Intake
Hard-Coded Cryptographic Key in xxl-job OpenAPI Endpoint

Publication date: 2026-04-28

Last updated on: 2026-04-29

Assigner: VulDB

Description
A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-28
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-04-29
EPSS Evaluated
2026-06-15
NVD
CVE-2026-7306
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
xuxueli xxl-job to 3.3.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-320 Key Management Errors
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Xuxueli xxl-job up to version 3.3.2, specifically in an unknown function within the OpenAPI Endpoint component of the file OpenApiController.java. The issue arises from manipulation of the argument named default_token, which leads to the use of a hard-coded cryptographic key. This flaw can be exploited remotely, but the attack requires a high level of complexity and is considered difficult to execute. The exploit has been publicly disclosed and may be used by attackers.

Impact Analysis

Exploitation of this vulnerability can lead to the compromise of confidentiality, integrity, and availability of the affected system. Since it involves the use of a hard-coded cryptographic key, attackers might bypass security controls or gain unauthorized access remotely. However, due to the high complexity and difficulty of the attack, the risk is moderate.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart