CVE-2026-75430 in Worker
Summary
by MITRE • 09/04/2026
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PowerJob Worker, specifically affecting version 5.1.2 and potentially earlier releases, represents a critical security misconfiguration that exposes an administrative interface to unauthenticated access over the network. The core of this issue lies in the exposure of the /worker/deployContainer HTTP endpoint on the default transport port without implementing any form of authentication or authorization controls. In distributed task scheduling systems like PowerJob, such endpoints are typically designed for internal communication between master and worker nodes within a trusted environment. However, when these interfaces are bound to all network interfaces or accessible from external networks without proper access restrictions, they become vulnerable to exploitation by remote attackers who can reach the target host on the specified port.
From a technical perspective, this flaw constitutes an improper authentication mechanism that allows unauthorized users to interact with sensitive system functions. The /worker/deployContainer endpoint is likely responsible for handling container deployment operations, which may involve executing scripts, launching processes, or modifying runtime configurations. Because there are no credentials required to invoke this service, any entity capable of sending HTTP requests to the exposed port can trigger these actions. This lack of access control effectively grants full administrative privileges over the worker node to anyone with network connectivity, bypassing standard security boundaries that should restrict such operations to authorized personnel or internal services only.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on PowerJob for their workflow automation needs. An attacker exploiting this flaw can achieve remote code execution (RCE) by deploying malicious containers or scripts through the exposed endpoint. This capability allows the adversary to run arbitrary commands with the privileges of the user account under which the PowerJob Worker service is operating. Depending on the system configuration, this could lead to complete compromise of the underlying host, lateral movement within the internal network, data exfiltration, or disruption of critical business processes managed by the task scheduler. The absence of authentication means that automated scanning tools and opportunistic attackers can easily discover and exploit this weakness without needing prior credentials or complex social engineering tactics.
This vulnerability aligns with several well-known industry standards for classifying security flaws. It is primarily categorized under CWE-287, which describes Improper Authentication, as the system fails to verify the identity of users attempting to access sensitive functionality. Additionally, it relates to CWE-434, Unrestricted Upload of File with Dangerous Type, if the container deployment involves uploading and executing arbitrary files or images. From an offensive security perspective, this behavior maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as attackers can use the endpoint to execute commands on the target system. It also corresponds to T1136, Create Account, if the exploitation involves creating new administrative accounts for persistent access, or T1484, Domain Policy Modification, if it allows changes to security policies that weaken overall defense in depth.
To mitigate this risk, immediate remediation steps should focus on restricting network-level access to the PowerJob Worker service. Administrators must ensure that the transport port is not exposed to untrusted networks by configuring firewalls or network segmentation rules to allow connections only from known master nodes and trusted internal subnets. Implementing mutual TLS (mTLS) authentication for inter-service communication can further secure these channels against spoofed requests. Additionally, enabling built-in security features if available, such as token-based authentication or API key verification for administrative endpoints, is essential. Regular vulnerability assessments and penetration testing should be conducted to identify similar misconfigurations in other services running on the same infrastructure. Keeping PowerJob updated to the latest version where this issue has been patched by the vendor is also a critical long-term strategy to prevent exploitation of known flaws.