External risk intelligence

PowerJob Worker Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75430

PowerJob worker nodes are typically deployed within internal network segments to process tasks and communicate with the server. While the endpoint is exposed over HTTP and reachable via network, it is not standard practice for worker nodes to be directly exposed to the public internet, though accidental exposure or misconfigured deployments in some environments remain plausible.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in PowerJob Worker, a technology used for distributed task scheduling. An unauthenticated remote attacker could exploit this by executing arbitrary code, potentially impacting the integrity and availability of systems running this software. The primary concern is to confirm if your organization utilizes this technology and assess any exposure.

Unprotected endpoint allows remote code execution.
Critical flaw could impact core business operations.
Verify if PowerJob is in use and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by interacting with the worker's HTTP endpoint over the network. This endpoint is exposed without requiring any authentication, allowing direct access to deploy code. When this endpoint is triggered, it can lead to the execution of arbitrary code on the system.

No authentication required.
Triggered by accessing HTTP endpoint.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to execute arbitrary code by accessing an exposed HTTP endpoint. This may impact the integrity and availability of the affected system.

System commands and code execution.
Unauthenticated HTTP endpoint access.
Arbitrary code execution on worker.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in PowerJob Worker's unauthenticated HTTP endpoint could allow remote code execution. Platform or application teams owning the PowerJob deployment should initiate an exposure review to identify all instances, confirm reachability, and assess business criticality. Prioritize remediation efforts based on this risk assessment, coordinating with security teams and potentially the vendor if necessary for mitigation strategies or patches.

Identify all PowerJob worker instances.
Confirm reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PowerJob Worker?

PowerJob Worker is a software component used in distributed task scheduling architectures. It functions as a node that executes background jobs and tasks as directed by a central PowerJob server. Organizations integrate this technology into their infrastructure to automate processing workflows and manage asynchronous computing tasks across a cluster of systems.

What does CVE-2026-75430 mean for system security?

This vulnerability is a critical flaw where the software fails to verify the identity of anyone connecting to a specific administrative endpoint. Because the system does not require authentication, it is susceptible to Improper Access Control, which allows an unauthorized remote party to send commands that the worker process then executes as if they were legitimate instructions.

How is this vulnerability triggered?

The issue is triggered when an attacker sends a specially crafted request to the /worker/deployContainer HTTP endpoint on the worker node. Simply having the service running is the core requirement for potential exploitation; authentication tokens or valid session credentials are not needed to invoke this function. Note that local administrative access to the server is not a prerequisite for this network-based attack.

Do I need to worry if my PowerJob workers are internal?

According to Halo Surface Signal, PowerJob worker nodes are usually situated within protected internal network segments. While this reduces the likelihood of broad internet-based exploitation, you should still evaluate your configuration. If your deployment has been misconfigured or accidentally exposed to the public internet, the risk level increases significantly.

How should I respond to this advisory?

Begin by conducting an inventory to locate all active PowerJob Worker instances across your environment. Once identified, verify if these nodes are reachable from unauthorized network segments. Coordinate with your engineering teams to restrict access to the worker's HTTP port and consult official project security documentation to plan for patching or hardening steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.