CVE-2026-82630: PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
PowerJob deployments up to version 5.1.2 are identified as impacted. The affected code is the Transport Endpoint's TestController.java, specifically MuConnectionManager.getOrCreateConnection.
Does exploitation require authentication or user interaction?
No. The provided vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
Is public exploit code available?
Yes. The vulnerability information states that a public exploit is available and may be used.
Is a vendor response or fix identified?
No response or fix is identified in the provided data. The project was reportedly notified through an issue report but had not responded at the time of publication.