CVE-2026-26718

Received Received - Intake

CSRF in xxl-job-admin Web Application

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: MITRE

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-07-16

AI Q&A

2026-07-16

EPSS Evaluated

N/A

NVD

CVE-2026-26718

Affected Vendors & Products

Vendor	Product	Version / Range
xxl-job	xxl-job-admin	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the xxl-job-admin web application version 3.0.0. It allows an attacker to trick a user into submitting unauthorized requests that modify Glue IDE shell scripts. The issue occurs because the affected endpoint does not validate CSRF tokens and accepts arbitrary HTTP methods due to overly permissive request mapping.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf, such as modifying shell scripts in the Glue IDE. This could lead to code execution, data breaches, or system compromise if the scripts control critical operations.

Compliance Impact

This vulnerability could lead to unauthorized modifications of scripts handling sensitive data, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing or altering protected information. Compliance may be impacted if the breach results in data loss or unauthorized access.

Mitigation Strategies

Immediately update xxl-job-admin to a version that includes proper CSRF token validation and restricts HTTP methods. Ensure the affected endpoint enforces strict request validation to prevent unauthorized modifications to Glue IDE shell scripts.

Hi! I’m here to help you understand CVE-2026-26718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70