CVE-2025-11581: Powerjob Auth Bypass Vulnerability

CVE-2025-11581 Overview

A missing authorization vulnerability has been identified in PowerJob versions up to 5.1.2. This vulnerability affects the /openApi/runJob endpoint within the OpenAPIController component, allowing remote attackers to execute jobs without proper authorization checks. The exploit has been disclosed publicly and may be actively used.

Critical Impact

Unauthorized remote attackers can trigger job execution through the OpenAPI endpoint, potentially leading to unauthorized actions, data manipulation, or service disruption within PowerJob deployments.

Affected Products

• PowerJob versions up to and including 5.1.2
• PowerJob OpenAPIController component
• Systems exposing the /openApi/runJob endpoint

Discovery Timeline

• 2025-10-10 - CVE-2025-11581 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-11581

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when the software does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of PowerJob, the /openApi/runJob endpoint in the OpenAPIController fails to verify that the requesting user has appropriate permissions to execute job operations.

The network-accessible nature of this vulnerability means that any attacker who can reach the PowerJob service over the network can potentially exploit this flaw without any authentication or authorization credentials. This creates a significant risk for organizations running PowerJob instances that are exposed to untrusted networks.

Root Cause

The root cause of this vulnerability lies in the OpenAPIController's failure to implement proper authorization checks before processing job execution requests. The /openApi/runJob endpoint accepts and processes requests without validating whether the requester has the necessary permissions to trigger job operations. This oversight in the access control implementation allows any network-accessible user to invoke job execution functionality that should be restricted to authorized users only.

Attack Vector

The attack can be launched remotely over the network. An attacker with network access to a vulnerable PowerJob instance can send crafted requests to the /openApi/runJob endpoint to trigger unauthorized job executions. The attack requires no user interaction and no prior authentication, making it straightforward to exploit.

The vulnerability exists in the OpenAPIController component where the runJob functionality is exposed without proper authorization validation. Attackers can directly interact with this endpoint to execute jobs, potentially causing unintended operations within the job scheduling system.

For detailed technical information, refer to the GitHub PowerJob Issue #1128 which documents this security concern.

Detection Methods for CVE-2025-11581

Indicators of Compromise

• Unexpected job executions appearing in PowerJob logs without corresponding authorized user activity
• HTTP requests to /openApi/runJob from unauthorized or unknown IP addresses
• Anomalous patterns of job triggering outside normal operational hours
• Increased API traffic to OpenAPI endpoints from external sources

Detection Strategies

• Implement logging and monitoring for all requests to the /openApi/runJob endpoint
• Deploy web application firewall (WAF) rules to detect and block unauthorized API access attempts
• Use network intrusion detection systems (IDS) to monitor for suspicious traffic patterns targeting PowerJob endpoints
• Enable audit logging within PowerJob to track all job execution requests and their sources

Monitoring Recommendations

• Configure alerting for job executions that do not correlate with authorized user sessions
• Monitor network traffic for unusual volume of requests to OpenAPI endpoints
• Review PowerJob application logs regularly for unauthorized access attempts
• Implement real-time monitoring for any changes to job configurations or unexpected job triggers

How to Mitigate CVE-2025-11581

Immediate Actions Required

• Restrict network access to PowerJob instances, especially the /openApi/runJob endpoint, using firewall rules
• Implement authentication mechanisms in front of the OpenAPI endpoints if not already present
• Audit recent job execution logs to identify any potential unauthorized activity
• Consider disabling the OpenAPI endpoint if it is not required for operations

Patch Information

Organizations should monitor the PowerJob GitHub Repository for security updates addressing this vulnerability. Upgrade to patched versions as soon as they become available from the vendor. Check the GitHub issue tracker for the latest status on fixes.

Workarounds

• Deploy a reverse proxy with authentication in front of PowerJob to enforce authorization on all API endpoints
• Configure network segmentation to ensure PowerJob is only accessible from trusted internal networks
• Implement IP whitelisting to restrict access to the OpenAPI endpoints to known, authorized sources
• Use API gateway solutions to add an authorization layer before requests reach the PowerJob application

# Example: Nginx reverse proxy with basic authentication for PowerJob
# Add to nginx configuration to protect /openApi endpoints

location /openApi/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://localhost:7700/openApi/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}