Patch Dromara Skyeye Before Commit 003549ae to Block Critical Unauthenticated Script Execution

A severe security flaw in the Dromara Skyeye monitoring platform allows unauthorized individuals to execute arbitrary code on affected servers. The vulnerability, tracked as CVE-2026-107779, enables attackers to run scripts without any form of authentication, posing an immediate risk to systems using the software.

The issue stems from missing authentication controls in the bundled xxl-job-admin component. Specifically, certain endpoints in the JobInfoController are annotated with `@PermissionLimit(limit = false)`, which effectively disables permission checks. This configuration allows anyone with network access to send requests to the `/jobinfo/addAndStart` endpoint. By posting specific job types—such as GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL—attackers can supply their own script content via the `glueSource` parameter. This results in the execution of those commands on the executor host. Additionally, the flaw permits attackers to stop or delete existing jobs, potentially disrupting operations.

Understanding the Technical Scope

The vulnerability is classified under CWE-306, which refers to missing authentication for critical functionality. According to the National Vulnerability Database record, the flaw is present in Dromara Skyeye versions leading up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. The severity rating of 9.3 indicates that the vulnerability is critical, reflecting the ease with which an attacker can exploit it and the significant impact on confidentiality, integrity, and availability.

The ability to execute PowerShell, Python, or shell scripts without credentials means that an attacker does not need to steal passwords or bypass login screens. If the affected service is exposed to the internet or an untrusted network, the attack surface is wide open. The execution happens on the executor host, meaning the attacker gains control over the system running the job scheduler. This level of access can lead to data theft, malware installation, or the use of the server as a pivot point for further attacks within the network.

Who Is Affected

Organizations using Dromara Skyeye for application monitoring and diagnostics are at risk. The vulnerability affects any installation running versions prior to the specified commit hash. Small businesses and enterprises that rely on this open-source tool for server health checks and performance monitoring should verify their current version immediately. If the system is connected to networks where untrusted users can send traffic, the risk of exploitation is high.

The bundled nature of xxl-job-admin within Skyeye means that users may not be aware they are running the vulnerable component. It is not a separate plugin that might be easily identified; it is part of the core distribution. Therefore, administrators cannot simply disable the vulnerable module without potentially breaking core functionality of the monitoring platform.

What to watch

Security researchers and vendors are monitoring the exploitation of this flaw in the wild. Given the simplicity of the attack vector—requiring only a POST request with specific parameters—automated bots may begin scanning for vulnerable instances shortly after disclosure. Organizations should monitor their logs for unusual job creation attempts or unexpected script executions.

There is no confirmed patch or fix available yet, according to the current source material. Users must rely on network-level controls to mitigate the risk until an official update is released. This includes restricting access to the Skyeye admin interface to trusted IP addresses only.

Background: Malware

Malware targets small businesses because they lack layered defenses. You must isolate sensitive data, restrict software execution, and verify IT provider backup integrity. Focus on reducing the attack surface through strict access controls and regular, offline data restoration tests.

Read the full guide: Malware Defense: Practical Steps for Small Business Security

What to do and how to stay safe: Dromara Skyeye

• Restrict network access to the Dromara Skyeye admin interface so that only authorized internal IPs can connect.
• Monitor server logs for unauthorized job creation events or unexpected execution of shell, Python, or PowerShell scripts.
• Verify the current commit or version of your Dromara Skyeye installation against the vulnerable range ending at commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
• Once the vendor provides an update, apply the patch immediately to resolve the missing authentication issue.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107779?

It is a critical missing authentication vulnerability in Dromara Skyeye that allows unauthenticated remote code execution.

How severe is this vulnerability?

It has a CVSS score of 9.3, which is rated as critical.

Which versions of Dromara Skyeye are affected?

Versions up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 are affected.