CVE-2026-75429 in PowerJob
Summary
by MITRE • 09/04/2026
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The PowerJob distributed task scheduling framework, specifically within version ranges spanning from 4.x up to and including 5.1.2, contains a critical security flaw that allows for unauthenticated remote code execution. This vulnerability resides in the /friend/process endpoint of the Server-Worker transport layer, which is responsible for facilitating communication between the central server node and worker nodes tasked with executing scheduled jobs. The architecture relies on this channel to transmit task instructions, status updates, and configuration data. However, due to insufficient access control mechanisms within this specific endpoint, an attacker who can reach the network segment hosting the PowerJob instance does not need valid credentials or authentication tokens to interact with it. This lack of mandatory authentication represents a fundamental failure in implementing proper security controls for sensitive administrative interfaces, allowing any external actor to initiate interactions that were intended solely for trusted internal components.
The technical nature of this vulnerability involves the processing of untrusted input data without adequate validation or sanitization before execution. When an attacker sends a crafted request to the /friend/process endpoint, they can inject malicious payloads into parameters such as task configurations or command strings. Because PowerJob is designed to execute arbitrary code and scripts on worker nodes for distributed computing purposes, these injected commands are processed by the server logic and subsequently dispatched to connected workers. The execution environment typically runs with elevated privileges necessary for system administration tasks, meaning that successful exploitation grants the attacker a high-level shell access to the underlying operating system of the affected servers or workers. This transforms what appears as a simple API endpoint into a direct vector for full system compromise, bypassing traditional perimeter defenses since it operates over standard network protocols often allowed through firewalls under legitimate operational traffic assumptions.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on PowerJob for critical business processes. An attacker can achieve complete control over the affected infrastructure, leading to data exfiltration, modification or destruction of persistent storage, lateral movement across internal networks, and establishment of persistence mechanisms such as backdoors or cron jobs. In cloud environments, this could lead to compromise of instance metadata services, allowing further escalation via attached IAM roles with excessive permissions. The absence of authentication means that automated scanning tools can easily discover and exploit this weakness at scale, posing a significant risk in public-facing deployments where the PowerJob interface is inadvertently exposed to the internet without proper reverse proxy protections or network segmentation.
To mitigate this vulnerability, immediate action is required by upgrading the PowerJob installation to version 5.1.3 or later, which addresses the authentication gap and hardens the transport layer security protocols. For organizations unable to upgrade immediately due to compatibility constraints with legacy systems, temporary mitigation strategies should be implemented at the network perimeter level. This includes configuring firewalls or reverse proxies such as Nginx or Apache to restrict access to the /friend/process endpoint exclusively from known internal IP addresses belonging to trusted worker nodes. Additionally, implementing mutual TLS authentication for all Server-Worker communications ensures that only clients presenting valid certificates can establish connections, effectively neutralizing unauthenticated exploitation attempts regardless of network exposure. Regular vulnerability assessments and penetration testing should be conducted to verify that these controls are functioning correctly and that no other endpoints in the application remain susceptible to similar bypass techniques aligned with CWE categories related to broken access control and injection flaws.