Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-08 | 3 | Disclosure3 |
| 2026-05-19 | 2 | Disclosure2 |
http://ZAST.AI identified and verified `CVE-2026-3733` in `XXL-JOB`. An admin trigger field in `/jobinfo/trigger` ended up acting like a live remoting destination. That is how routine scheduling metadata became SSRF surface. https://t.co/owCIdcTNdC
Post summary
ZAST.AI identified a new SSRF vulnerability (CVE-2026-3733) in XXL-JOB where an admin trigger field can be used as a live remoting destination, enabling SSRF attacks.
Security note: ZAST identified and verified `CVE-2026-3733` in `XXL-JOB`. The admin trigger flow accepted `addressList` and used it to drive an outbound server request. That created an SSRF path. https://t.co/ciQ7eP83JK
Post summary
ZAST identified its SSRF vulnerability (CVE-2026-3733) in XXL-JOB, noting that the admin trigger flow accepts an addressList and uses it to make outbound server requests, creating a potential SSRF path.
CVE-2026-3733 A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfo… https://www.cve.org/CVERecord?id=CVE-2026-3733
Post summary
A new vulnerability (CVE‑2026‑3733) has been identified in xuxueli xxl‑job up to version 3.3.2, affecting an unspecified function in the JobInfo controller, with no further details or patches disclosed.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3733 - xuxueli xxl-job http://JobInfoController.java server-side request forgery Intel Report: https://ift.tt/zmJ0arZ
Post summary
The alert announces a newly disclosed CVE‑2026‑3733 affecting xuxueli xxl‑job, identified as a server‑side request forgery, with an Intel report link but no evidence of exploitation, PoC, or patch details.
CVE-2026-3733 Server-Side Request Forgery in XXL-Job Admin Controller Before Version 3.3.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3733
Post summary
The text announces a new SSRF vulnerability (CVE‑2026‑3733) affecting XXL‑Job Admin Controller prior to version 3.3.2, providing basic technical details but no PoC, exploit, or mitigation information.