xxl-job: 3,350 application matches against 148 page titles

The distributed task scheduling platform xxl-job revealed a discrepancy in inventory between its application fingerprint and title. A measurement on 23 October 2026 found 3,350 application matches compared to 148 title matches. The 3,350 figure includes all recognisable assets identified by the fingerprint, while the 148 number refers to pages with titles containing the product name.

Seventeen of those pages also responded on port 8080, the usual console port. The console acts as a management interface where operators can manage executors, view job definitions, and trigger jobs. Executors communicate with the admin to receive trigger requests and execute scheduled tasks. The console's exposure increases due to executors needing to reach it, operators accessing it remotely, and monitoring requirements.

These factors contribute to the disparity between the fingerprint counts and title matches. To address this, administrators should enumerate admin consoles and executor nodes separately, assess whether public access is necessary, review authentication settings, restrict executor registration to known addresses, and monitor executor behavior for potentially unauthorized parameter edits.