Cross-Site Request Forgery Vulnerability in XXL-Job-Admin Web Application
CVE-2026-26718

Currently unrated

Key Information:

Vendor: xxl-job-admin
Status: xxl-job-admin
Vendor: CVE Published:; 15 July 2026

🔔 Create xxl-job-admin Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-26718?

A Cross-Site Request Forgery vulnerability has been identified in the XXL-Job-Admin web application version 3.0.0. This flaw permits attackers to execute unauthorized modifications to Glue IDE shell scripts. The vulnerability arises due to inadequate CSRF token validation and the acceptance of arbitrary HTTP methods, creating a significant security risk for the affected application.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-26718
Created by Ibrahim-Sartawi

References

https://xxl-job-admin.com

https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Download the Critical Vulnerability Management Cheat Sheet

Timeline

🟡
Public PoC available
Jul 15, 2026
👾
Exploit known to exist
Jul 15, 2026
Vulnerability published
Jul 15, 2026
Vulnerability Reserved
Feb 16, 2026

CVE-2026-26718 Data

JSON