{"vulnerability": "CVE-2026-7543", "sightings": [{"uuid": "af3fde25-e1e5-41cf-a103-b3c3b3a4f8e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75430", "type": "seen", "source": "https://gist.github.com/unpredictable21/fcb62d394db30525412c4b5b1efd0233", "content": "# CVE-2026-75430 - PowerJob Worker /worker/deployContainer Unauthenticated Remote Code Execution\n\n## Basic Info\n\n| Field | Value |\n|---|---|\n| **CVE ID** | CVE-2026-75430 |\n| **Vulnerability Type** | Remote Code Execution (RCE) |\n| **Vendor of Product** | https://github.com/PowerJob/PowerJob |\n| **Affected Product Code Base** | PowerJob - 5.1.2 (and likely earlier versions) |\n| **Attack Type** | Remote |\n| **Impact** | Code execution |\n| **Discoverer** | Yujie He |\n\n## Summary\n\nPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.\n\n## Additional Information\n\nThe default docker-compose.yml publishes the Worker port 27777 to the host, making the attack surface externally accessible. The Worker requires the application to be registered with the PowerJob Server during startup (via /server/assert); otherwise, the Worker process exits and port 27777 is not listening. However, in any production or demo deployment where the Worker is actually running, this precondition is satisfied, and the exploit is fully unauthenticated.\n\nA working Proof-of-Concept (PoC) Python script has been developed that automatically builds the malicious JAR, hosts it, and triggers the vulnerability; it is available upon request to the vendor or security team. The vulnerability has been confirmed on PowerJob 5.1.2 with both JDK 8 and JDK 21 environments.\n\n## Affected Components\n\n- powerjob-worker (powerjob-worker-samples)\n- WorkerActor.java\n- OmsContainerFactory.java\n- OmsJarContainer.java\n- OhMyClassLoader.java\n- ClassPathXmlApplicationContext (Spring)\n\n## References\n\n- https://github.com/PowerJob/PowerJob\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-worker/src/main/java/tech/powerjob/worker/actors/WorkerActor.java\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-worker/src/main/java/tech/powerjob/worker/container/OmsContainerFactory.java\n- https://github.com/PowerJob/PowerJob/blob/master/SECURITY.md\n\n## Proof of Concept\n\nhttps://github.com/unpredictable21/PowerJob_PJ09_worker_deployContainer_RCE_\n", "creation_timestamp": "2026-09-04T09:43:50.601854Z"}, {"uuid": "86b142ec-7fa3-493d-ab25-7efbb5e445bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75431", "type": "seen", "source": "https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c", "content": "# CVE-2026-75431 - PowerJob Server Predictable JWT Signing Key Remote Code Execution\n\n## Basic Info\n\n| Field | Value |\n|---|---|\n| **CVE ID** | CVE-2026-75431 |\n| **Vulnerability Type** | Remote Code Execution (RCE) |\n| **Vendor of Product** | https://github.com/PowerJob/PowerJob |\n| **Affected Product Code Base** | PowerJob - 5.1.2 (and likely earlier) |\n| **Attack Type** | Remote |\n| **Impact** | Code execution |\n| **Discoverer** | Yujie He |\n\n## Summary\n\nPowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.\n\n## Additional Information\n\nThe vulnerability has been verified end-to-end on PowerJob 5.1.2 with the default configuration. The derived encryptedToken (ADMIN_b82a450701f6a71723fb99931fe35e18_b) exactly matches the value stored in the database for the PWJB_ADMIN account when using the default password. A proof-of-concept Python script (powerjob_jwt_forge.py) has been developed that computes the key and generates a valid admin JWT offline; it successfully bypasses authentication on /namespace/list and returns real data.\n\nThe issue is exacerbated by the fact that the JDBC URL is often left unchanged in production deployments, making the key fully predictable. A separate OpenAPI App Token forgery path exists even if the admin password is changed.\n\n## Affected Components\n\n- powerjob-server-auth\n- DefaultSecretProvider.java (fetchSecretKey)\n- JwtServiceImpl.java (genSecretKey)\n- powerjob-server-openapi (OpenApiSecurityServiceImpl)\n\n## References\n\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/DefaultSecretProvider.java\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/JwtServiceImpl.java\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-openapi/src/main/java/tech/powerjob/server/openapi/service/impl/OpenApiSecurityServiceImpl.java\n- https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml\n- https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-starter/src/main/resources/application-daily.properties\n\n## Proof of Concept\n\nhttps://github.com/unpredictable21/PowerJob_jwt_key_predictable\n", "creation_timestamp": "2026-09-04T09:45:00.371415Z"}, {"uuid": "f4f8588b-7998-4773-8062-2dcd6b0f54e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75430", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mupkabrhkl2e", "content": "\ud83d\udd34 CVE-2026-75430 - Critical (9.8)\n\nPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer H...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75430/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-04T18:00:52.185053Z"}, {"uuid": "bf42edbc-e579-4027-9c70-e6efeeebd56c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75431", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mupko5ze6u2w", "content": "\ud83d\udea8 CVE-2026-75431 \u2014 CVSS 9.1 CRITICAL\n\nPowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75431\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T18:08:37.096722Z"}, {"uuid": "1d65b328-3a19-4e2c-a418-1f8201adbfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75430", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mupkojv6262o", "content": "\ud83d\udea8 CVE-2026-75430 \u2014 CVSS 9.8 CRITICAL\n\nPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75430\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T18:08:49.769574Z"}, {"uuid": "2694a427-032a-4c87-9a62-c0cf7b70bcac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75430", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muponwx4ku2v", "content": "CVE-2026-75430\nPowerJob Worker version 5.1.2 (and likely earlier) opens a web address that anyone can reach without a login. An outside attacker could use this to run any program they choose on your server. Update the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-04T19:20:04.843879Z"}, {"uuid": "9dbe6a93-73ae-4742-866f-8196cfbe99ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75431", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muqvvtz5z62z", "content": "\ud83d\udd34 CVE-2026-75431 - Critical (9.1)\n\nPowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-b...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75431/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-05T07:02:26.659238Z"}, {"uuid": "75da4f63-a9c7-469d-90ef-80b5d37d1818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75431", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muzwopq44m2c", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-75431: PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication\nCVSS 9.1 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-75431\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-08T21:10:17.856175Z"}, {"uuid": "7af76b11-7399-43b1-bae2-94c98ad03747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75430", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muzworfnub2z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-75430: PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication\u2026\nCVSS 9.8 \u00b7 EPSS 0.9%\nhttps://beta.vulnsea.com/cve/CVE-2026-75430\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-08T21:10:19.616090Z"}, {"uuid": "c10668f8-ee82-472c-8980-1276f7efc520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75439", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117253867833382813", "content": "CVE-2026-75439: Free5GC v.4.2.2 has a remote DoS flaw in the UPF component\u2014crash the whole core network. CVSS: N/A (still unpatched). Act fast: isolate UPF, apply vendor workarounds, and monitor traffic. Details: https://www.valtersit.com/cve/CVE-2026-75439/ #infosec #5G #CVE", "creation_timestamp": "2026-09-11T18:40:37.148791Z"}, {"uuid": "6b60aea5-21a7-44dc-a421-1d1ad26863c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75439", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mvbaaqmozc2e", "content": "CVE-2026-75439: Free5GC v.4.2.2 has a remote DoS flaw in the UPF component\u2014crash the whole core network. CVSS: N/A (still unpatched). Act fast: isolate UPF, apply vendor workarounds, and monitor traffic. Details: https://www.valtersit.com/cve/CVE-2026-75439/ #infosec #5G #CVE", "creation_timestamp": "2026-09-11T18:50:05.060262Z"}]}