CVE-2026-26718

critical · 9.1

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

9.1

CVSS

0.2%

EPSS (exploit prob.)

13th

EPSS percentile

2026-07-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-352

References

https://github.com/Ibrahim-Sartawi/CVE-2026-26718
https://xxl-job-admin.com
https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-26718