CVE-2026-5739
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.
Risk Assessment
A remote attacker can execute arbitrary code on the PowerJob server, potentially leading to full system compromise and data access.
Recommendation
Contact the PowerJob team for a patch or consider temporarily disabling the OpenAPI endpoint if possible.
Other vulnerabilities in PowerJob
See all- CVE-2023-37754Critical
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
- CVE-2026-5736High
In PowerJob 5.1.0/5.1.1/5.1.2, the detailPlus endpoint in InstanceController.java is vulnerable to SQL injection via the customQuery argument. Remote exploitation is possible. The project was notified but has not responded.
- CVE-2023-36106High
CVE-2023-36106 describes an incorrect access control vulnerability in powerjob version 4.3.2 and earlier, allowing remote attackers to obtain sensitive information via the querying interface using the appId parameter to /container/list.
Original NVD description (English source)
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.