CVE-2026-7306 - Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

Back Back to CVE browser

MEDIUM

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

Published Apr 28, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.42%

Description

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.

Affected products

Vendor Xuxueli Product Xxl-Job Default
n/a
- Version
  3.3.0
  Status
  affected
  Constraints
  -
- Version
  3.3.1
  Status
  affected
  Constraints
  -
- Version
  3.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xuxueli

Xxl-Job

n/a

Version	Status	Constraints
3.3.0	affected	-
3.3.1	affected	-
3.3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-320

CWE-321

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26150
Advisory
https://github.com/xuxueli/xxl-job/
product
https://github.com/xuxueli/xxl-job/issues/3938
exploitissue-tracking
https://github.com/xuxueli/xxl-job/issues/3938#issuecomment-4149938881
issue-tracking
https://vuldb.com/submit/803077
third-party-advisory
https://vuldb.com/vuln/359961
vdb-entrytechnical-description
https://vuldb.com/vuln/359961/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26150		Advisory
https://github.com/xuxueli/xxl-job/		product
https://github.com/xuxueli/xxl-job/issues/3938		exploitissue-tracking
https://github.com/xuxueli/xxl-job/issues/3938#issuecomment-4149938881		issue-tracking
https://vuldb.com/submit/803077		third-party-advisory
https://vuldb.com/vuln/359961		vdb-entrytechnical-description
https://vuldb.com/vuln/359961/cti		signaturepermissions-required