https://vulnerability.circl.lu/sightings/feed 2026-10-01T07:44:07.840455+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4e567e5f-941d-4fe4-b632-666e3187c675/export 2026-10-01T07:44:07.868861+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4e567e5f-941d-4fe4-b632-666e3187c675", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75429", "type": "seen", "source": "https://gist.github.com/unpredictable21/dbd1791294c9a77ad0ee3d4827073966", "content": "# CVE-2026-75429 - PowerJob Server /friend/process Unauthenticated Remote Code Execution\n\n## Basic Info\n\n| Field | Value |\n|---|---|\n| **CVE ID** | CVE-2026-75429 |\n| **Vulnerability Type** | Remote Code Execution (RCE) |\n| **Vendor of Product** | https://github.com/PowerJob/PowerJob |\n| **Affected Product Code Base** | PowerJob - 5.1.2 (and earlier 4.x through 5.1.2) |\n| **Attack Type** | Remote |\n| **Impact** | Code execution |\n| **Discoverer** | Yujie He |\n\n## Summary\n\nPowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer.\n\n## Additional Information\n\nThe vulnerability affects PowerJob Server 5.1.2 and all earlier versions sharing the same transport-layer design (4.x through 5.1.2). The attack does not require database connectivity or any form of authentication. The default docker-compose.yml exposes port 10010 (HTTP transport), 10086 (AKKA), and 10077 (MU) to host 0.0.0.0, increasing the exposure risk.\n\nThe CVSS v3.1 score is **9.8 (Critical)**.\n\n## Suggested Remediation\n\n- Implement mutual Server-Worker authentication\n- Restrict RemoteRequestProcessor to an allowlist of safe handlers\n- Remove remote accessibility of GroovyEvaluator\n- Disable /friend/process by default or limit it to internal trusted sources only\n\n## Affected Components\n\n- tech.powerjob.server.remote.server.FriendActor\n- tech.powerjob.server.remote.server.redirector.RemoteRequestProcessor\n- tech.powerjob.server.core.evaluator.GroovyEvaluator\n- tech.powerjob.remote.http.HttpVertxCSInitializer\n\n## References\n\n- https://github.com/PowerJob/PowerJob\n- https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml\n\n## Proof of Concept\n\nhttps://github.com/unpredictable21/PowerJob_PJ08_friend_process_RCE\n", "creation_timestamp": "2026-09-04T09:43:50.668166Z"} 2026-09-04T09:43:50.668166+00:00