PowerJob CVE-2026-75429

Exploitation requires network reachability to the PowerJob server's Server-Worker transport layer (the port the server exposes for worker communication, commonly deployed via the project's docker-compose). The specific attack surface is the /friend/process endpoint, which performs no authentication - so any actor able to reach that port can send the malicious payload against default configurations of PowerJob 4.x through 5.1.2. The primary limiting factor is exposure: in well-segmented deployments the server-worker transport port is internal and not internet-facing, so realistic risk concentrates on flat networks, cloud deployments that expose the port, or post-perimeter attackers. No authentication, user interaction, or non-default feature toggle is required once the endpoint is reachable.

This is a high-priority issue with strongly self-consistent signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes unauthenticated, low-complexity network RCE, which the description directly corroborates ('unauthenticated remote code execution' in the /friend/process endpoint of the Server-Worker transport layer). Unlike many inflated 9.8 kernel/UAF ratings, the CVSS here appears well-calibrated: a real RCE in an unauthenticated internal transport endpoint genuinely yields C:H/I:H/A:H. Publicly available exploit code exists (a PoC gist and a dedicated GitHub PoC repo, github.com/unpredictable21/CVE-2026-75429_PowerJob_friend_process_RCE), which raises real-world weaponization potential. EPSS is only 0.62% (47th percentile), which is modest - this reflects PowerJob's narrower deployment footprint relative to ubiquitous software rather than low exploitability, and typically lags fresh PoC publication. No CISA KEV entry and no SSVC data were provided. Note two data-quality caveats: CWE-287 (authentication bypass) understates the true weakness class (an RCE, likely deserialization/CWE-502 or code injection/CWE-94 reachable because the endpoint is unauthenticated), and the CPE/affected-version fields are junk placeholders ('n/a'), so precise version boundaries rely solely on the description string (4.x through 5.1.2).

An attacker locates a PowerJob server whose Server-Worker transport port is reachable and sends a crafted request to the unauthenticated /friend/process endpoint, triggering code execution on the server host. Because the endpoint requires no authentication and public exploit code exists (PoC gist and GitHub repo), an attacker can adapt working proof-of-concept rather than developing an exploit from scratch. Successful exploitation yields full command execution in the context of the PowerJob server process, enabling scheduler takeover and pivoting to connected workers.