Unauthenticated Remote Code Execution in PowerJob Server-Worker

Executive Summary

CVE-2026-75429 is a critical unauthenticated remote code execution (RCE) vulnerability in PowerJob Server versions 4.x through 5.1.2. The flaw exists in the /friend/process endpoint of the Server-Worker transport layer, allowing attackers to execute arbitrary code without authentication or database connectivity.

Useful 0 Not Useful 0

Detection Guidance

Check if PowerJob Server versions 4.x through 5.1.2 are running on your network. Inspect network traffic for requests to the /friend/process endpoint. Use tools like curl or netcat to probe the endpoint for unauthenticated access. Example: curl -v http://<target>:10010/friend/process. Monitor logs for unexpected code execution or Groovy evaluator usage.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or disruption of services. The default docker-compose.yml exposes multiple ports to host 0.0.0.0, increasing the attack surface.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PowerJob Server to a version beyond 5.1.2 if available. Restrict access to the /friend/process endpoint via firewall rules. Disable GroovyEvaluator remotely and implement mutual Server-Worker authentication. Limit or disable the /friend/process endpoint entirely if not required.

Useful 0 Not Useful 0