by Kastro
Paper/Archive/CVE-2026-75430

CVE-2026-75430

mitre — PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on t…

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.0.690 × 2013.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)9.8CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PowerJob/PowerJobrefgithub.com/PowerJob/PowerJob/blob/master/powerjob-worker/src/main/java/tech/powerjob/worker/actors/WorkerActor.javarefgithub.com/PowerJob/PowerJob/blob/master/powerjob-worker/src/main/java/tech/powerjob/worker/container/OmsContainerFactory.javarefgithub.com/PowerJob/PowerJob/blob/master/SECURITY.mdrefgist.github.com/unpredictable21/fcb62d394db30525412c4b5b1efd0233