Description

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T17:16:57.767Z",
  "pubdate": "2026-09-04T17:16:57.767Z",
  "executiveSummary": "PowerJob Worker version 5.1.2 and earlier versions contain a critical security vulnerability involving the lack of authentication on the /worker/deployContainer HTTP endpoint.\nThis flaw facilitates remote code execution (RCE) by allowing an unauthenticated attacker to interact with the container deployment functionality of the PowerJob Worker service.\nThe vulnerability resides within the worker's transport layer, exposing management interfaces directly over the network without requiring valid credentials.\nImpact includes complete system compromise, where a remote attacker can execute arbitrary commands with the privileges of the worker process.\nThis represents a high-risk security deficit, as the service does not enforce identity verification or authorization checks for administrative or operational API endpoints.\nExploitation requires network access to the target's configured transport port, allowing unauthorized deployment or execution of code within the worker's execution environment.",
  "technicalDetails": "The vulnerability originates from the insecure implementation of the /worker/deployContainer endpoint in PowerJob Worker versions 5.1.2 and earlier. This endpoint, which is designed to handle container deployments, fails to implement any form of authentication or access control mechanisms.\nThe root cause is the exposure of an administrative deployment interface over the default transport port, which accepts HTTP requests without validating the caller's identity or authorization status. By design, the /worker/deployContainer endpoint performs operations that facilitate the loading and execution of code within the JVM (Java Virtual Machine) environment utilized by the PowerJob Worker.\nAn attacker can exploit this by sending a crafted HTTP request directly to the /worker/deployContainer endpoint. Because the application logic lacks a security filter or authentication interceptor for this specific route, the worker process proceeds to process the request as if it originated from a legitimate PowerJob Server node.\nThe attack flow follows a sequential process: First, the attacker identifies the target worker's transport port via network reconnaissance. Second, the attacker crafts a malicious request targeting the /worker/deployContainer path, potentially including serialized objects or deployment metadata required by the service to instantiate a container. Third, upon receiving the request, the worker service parses the payload and triggers the execution of the contained logic. Because the worker process operates with the permissions of the service account under which it is executed, the injected code gains full control over the worker's execution context.\nThe exploitation allows an attacker to bypass legitimate job scheduling and deployment workflows, effectively turning the worker node into an arbitrary command execution platform. Post-exploitation, the attacker can leverage the compromised worker to pivot deeper into the internal network, steal sensitive configuration data, or perform lateral movement within the distributed task processing cluster. Given that the endpoint is exposed globally on the default port, any entity with network path access to the worker can initiate this attack, making the vulnerability particularly severe in environments where worker nodes are exposed to wide area networks or insufficiently firewalled subnets."
}