CVE-2026-107779

Summary

This vulnerability allows unauthenticated attackers to execute commands on the executor host by posting malicious job scripts through the JobInfoController endpoints.

Exploitability

Exploitation is relatively easy as it requires no authentication and can be done by sending a POST request to the /jobinfo/addAndStart endpoint.

Blast radius

If exploited, the impact could be severe, as it allows full control over the executor host, potentially leading to data loss, system compromise, or denial of service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the fixed version 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.