EUVD-2026-71612
GHSA-rqfm-jvh7-6hjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed worker transport port
-
DeliverySend crafted /worker/deployContainer request
-
ExploitWorker loads attacker container module
-
ExecutionArbitrary code executes as worker process
-
ImpactHost compromise / lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the PowerJob worker's default transport (HTTP) port and that the /worker/deployContainer endpoint is served without authentication, which is the default per the description; no credentials, no user interaction, and no special configuration are needed against a default-configured worker version 5.1.2 or earlier. The primary limiting factor is exposure of the worker transport port: if that port is firewalled to only the PowerJob server or on an isolated internal segment, remote attackers cannot reach the vulnerable endpoint. |
| Impact | This is a genuine high-priority issue rather than a paper-critical one: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) describes network-reachable, no-authentication, no-interaction code execution, and that aligns cleanly with the description of an unauthenticated endpoint that deploys arbitrary containers. The presence of a public gist suggests exploit tooling is circulating, which raises real-world exposure even though the CVE is not in CISA KEV and no EPSS score was supplied. The main mitigating factor is network reachability of the worker transport port - workers are often deployed on internal networks behind the PowerJob server - so blast radius depends heavily on whether the port is exposed beyond a trusted segment; any operator or mid-sized team running PowerJob workers with that port reachable should treat this as urgent and patch or firewall it immediately. Absent EPSS and KEV signals, confidence in 'active widespread exploitation' is low, but the combination of trivial exploitability and probable public PoC makes prompt remediation warranted. |
| Exploit ScenarioDerived | An attacker who can reach a PowerJob worker's transport port sends a crafted HTTP request to /worker/deployContainer specifying an attacker-hosted container/module, which the worker fetches, loads, and executes, yielding code execution as the worker process user. With no authentication or user interaction required, this can be scripted against any exposed worker, and a public gist referenced with the advisory appears to provide proof-of-concept material. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
RemediationAI
No vendor-released fixed version is identified in the provided data, so treat patch status as unconfirmed and monitor the PowerJob project and its SECURITY.md (https://github.com/PowerJob/PowerJob/blob/master/SECURITY.md) for an updated release beyond 5.1.2. In the meantime apply network-level compensating controls: restrict the worker transport port to only the trusted PowerJob server IP(s) via host firewall or security-group rules so the /worker/deployContainer endpoint is unreachable from untrusted networks - the trade-off is that server and workers must be on a controlled segment, which is standard for this architecture and should cause no functional loss. Additionally, do not expose worker nodes directly to the internet, place them behind a segmented internal network, and disable or avoid using the container-deployment feature if your job definitions do not require dynamic container modules. Validate that upstream fixes (once published) actually add authentication/authorization to the deploy path before relying on an upgrade alone.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerJob is a distributed task-scheduling and computing framework written in Java, split into a server (scheduler) and worker (executor) tier that communicate over a transport port. The referenced source files - WorkerActor.java and OmsContainerFactory.java - indicate the flaw lives in the worker's actor message handling and its container/module deployment factory: the deployContainer routine loads and instantiates externally supplied container modules (JAR-based 'OmsContainer' processors) without an authentication or trust check on the requester. Because deploying a container equates to loading and executing attacker-supplied code, this is an unauthenticated code-loading/execution class issue (the record lists CWE as N/A, but it maps functionally to unrestricted upload/deserialization-style code execution, CWE-434/CWE-306 missing-authentication territory). The CPE is a placeholder ('cpe:2.3:a:n/a:n/a'), so the exact affected component must be read from the description: powerjob-worker at 5.1.2 and earlier.
Know when Powerjob gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable endpoint deploys arbitrary code with no interaction, yielding full host compromise, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.
Executive ViewAI
PowerJob Worker 5.1.2 and earlier versions expose an unauthenticated remote code execution vulnerability in the /worker/deployContainer endpoint, allowing attackers to deploy and execute arbitrary code on job execution infrastructure without credentials; publicly available exploit code exists. This directly compromises all batch processing pipelines and scheduled task execution across affected workers. Organizations running PowerJob face complete infrastructure takeover with risk of lateral movement to connected systems and data stores.
Deploy strict firewall rules and network access controls limiting /worker/deployContainer endpoint access to whitelisted internal networks only; implement a reverse proxy or API gateway requiring authentication (mutual TLS, API keys, or OAuth) in front of the worker endpoint; isolate PowerJob worker infrastructure from sensitive systems and data repositories; enable comprehensive audit logging on all job deployment and execution activity with alerting on suspicious patterns; run workers in containerized or sandboxed environments with minimal resource permissions and elevated privilege isolation to constrain blast radius.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at
Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Wo
Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. Rated critical severity (CVSS 9.8), this vuln
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. Rated critical severity
PowerJob V4.3.2 has unauthorized interface that causes remote code execution. Rated critical severity (CVSS 9.8), this v
Missing authorization in PowerJob through 5.1.2 exposes the /user/list endpoint, allowing remote unauthenticated attacke
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. Rated medium severity (CVS
PowerJob V4.3.1 is vulnerable to Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. Rated medium severity (CVSS 5.3)
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 si
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive info
Remote code injection in PowerJob 5.1.0, 5.1.1, and 5.1.2 allows unauthenticated attackers to execute arbitrary code via
Exploit-DB