CVE-2026-75429_PowerJob_friend_process_RCE

PowerJob 服务器通过未认证的 /friend/process（Groovy 注入）实现远程代码执行 1. 概述 PowerJob 服务器（分布式任务调度/计算框架）在其 Worker↔Server 传输层 HTTP 端口 10010 上暴露了 /friend/process 端点，且完全没有身份认证 。该端点会反射调用任意 Spring Bean 的任意公共方法；攻击者调用 GroovyEvaluator.evaluate 即可执行任意 Groovy 表达式，实现未认证的远程代码执行 。默认的 docker-compose 将该端口发布到...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer . A public proof-of-concept is available via a gist , which was also logged as a sighting by CIRCL on 2026-09-04. No specific pat...

EUVD-2026-71453

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...