CVE-2026-75429

PowerJob, an open-source distributed job scheduling framework, contains an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer, affecting versions 4.x through 5.1.2. Because the endpoint does not properly authenticate the connecting party (an improper authentication flaw, CWE-287), an attacker who can reach the PowerJob server's transport port can submit crafted requests that are executed as code on the server, yielding full compromise with no credentials required. The CVSS 3.1 base score is 9.8 (network vector, low attack complexity, no privileges needed) with high impact on confidentiality, integrity, and availability. Any organization self-hosting a PowerJob server within the affected version range and exposing the server-worker communication layer is at risk. As of this writing, no public proof-of-concept exists, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported, though EPSS sits at the 48th percentile, suggesting moderate attention from attackers.

What to do: Upgrade PowerJob to the latest release newer than 5.1.2 that contains the fix for this CVE. Until patched, restrict network access to the server-worker transport layer (the /friend/process endpoint and its listening port) to trusted worker hosts only via firewall or network segmentation, and do not expose it to the internet. Review server logs for unexpected requests to /friend/process, unknown worker registrations, or suspicious job/process executions that could indicate attempted compromise.