EUVD-2026-71448
GHSA-f4hf-w5c6-r4p5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Predictable key enables unauthenticated remote token forgery (AV:N/AC:L/PR:N/UI:N) leading to RCE, so C/I/A all High - A:H corrects the input's A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.
AnalysisAI
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 signing key used for the server's JWT authentication, letting an unauthenticated remote attacker forge valid admin session tokens and drive PowerJob's job-execution features to run arbitrary code. PowerJob is an open-source distributed task-scheduling framework, and because the secret is derived by a default provider rather than randomly generated, any exposed instance is trivially impersonatable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the PowerJob Server run with its default/predictable HS256 JWT signing key (as generated by DefaultSecretProvider rather than a per-install random secret) and that the server's console or OpenAPI endpoint be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) indicates a network-reachable, low-complexity, unauthenticated attack - consistent with token forgery against an exposed server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified at time of analysis (references point to master-branch source files and a PoC, not a tagged fixed release), so verify the latest PowerJob release for a fix before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all PowerJob Server instances across production and development environments, document version numbers, and immediately isolate any running 5.1.2 or earlier from untrusted networks if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContain
Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. Rated critical severity (CVSS 9.8), this vuln
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. Rated critical severity
PowerJob V4.3.2 has unauthorized interface that causes remote code execution. Rated critical severity (CVSS 9.8), this v
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. Rated medium severity (CVS
PowerJob V4.3.1 is vulnerable to Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. Rated medium severity (CVSS 5.3)
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive info
Remote code injection in PowerJob 5.1.0, 5.1.1, and 5.1.2 allows unauthenticated attackers to execute arbitrary code via
Server-side request forgery in PowerJob up to version 5.1.2 allows authenticated remote attackers to manipulate the targ
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allShare
External POC / Exploit Code
Leaving vuln.today