CVE-2026-5739: PowerJob RCE Vulnerability

CVE-2026-5739 Overview

A code injection vulnerability has been discovered in PowerJob versions 5.1.0, 5.1.1, and 5.1.2. The affected element is the function GroovyEvaluator.evaluate within the /openApi/addWorkflowNode endpoint of the OpenAPI component. Manipulation of the nodeParams argument enables remote attackers to inject and execute arbitrary code on the target system. This vulnerability can be exploited remotely without authentication, making it particularly dangerous for exposed PowerJob instances.

Critical Impact

Remote attackers can inject malicious Groovy code through the OpenAPI endpoint, potentially achieving arbitrary code execution on PowerJob servers managing distributed task scheduling infrastructure.

Affected Products

• PowerJob 5.1.0
• PowerJob 5.1.1
• PowerJob 5.1.2

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-5739 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-5739

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as Injection). The flaw resides in how PowerJob processes workflow node parameters through its OpenAPI interface. When workflow nodes are added via the /openApi/addWorkflowNode endpoint, the application passes user-supplied nodeParams data directly to the GroovyEvaluator.evaluate function without adequate sanitization or validation.

Groovy is a dynamic scripting language for the Java Virtual Machine (JVM), and the GroovyEvaluator component is designed to evaluate Groovy expressions for workflow automation purposes. However, when untrusted input reaches this evaluation function, it creates a direct path for code injection attacks.

The vulnerability can be exploited remotely over the network, requires no prior authentication or user interaction, and enables attackers to execute arbitrary Groovy code within the context of the PowerJob application server.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of sandboxing in the Groovy expression evaluation pathway. The GroovyEvaluator.evaluate function accepts and processes the nodeParams argument without implementing proper input sanitization, allowlisting of safe operations, or execution sandboxing. This allows specially crafted input containing malicious Groovy code to be interpreted and executed by the Groovy runtime engine.

Attack Vector

The attack is initiated remotely over the network by sending a malicious HTTP request to the /openApi/addWorkflowNode endpoint. An attacker crafts a request with a manipulated nodeParams parameter containing Groovy code designed to execute system commands or perform other malicious operations. When the PowerJob server processes this request, the malicious payload is passed to GroovyEvaluator.evaluate and executed within the JVM context.

Attackers could leverage this vulnerability to execute arbitrary system commands, read or modify sensitive data, establish persistence mechanisms, pivot to other systems on the network, or deploy ransomware and other malicious payloads. The lack of authentication requirements for the affected endpoint significantly lowers the barrier for exploitation.

The vulnerability has been reported to the PowerJob project through GitHub Issue #1168, though the project has not yet responded to the security disclosure.

Detection Methods for CVE-2026-5739

Indicators of Compromise

• Unusual HTTP POST requests to /openApi/addWorkflowNode endpoint containing Groovy code patterns such as Runtime.getRuntime(), ProcessBuilder, or execute()
• Unexpected process spawning from the PowerJob Java process
• Suspicious outbound network connections originating from the PowerJob server
• Anomalous workflow nodes created with unusual or obfuscated nodeParams values

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing Groovy code injection patterns in API parameters
• Monitor PowerJob application logs for errors or exceptions related to Groovy evaluation failures that may indicate exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to identify suspicious child processes spawned by the Java runtime hosting PowerJob
• Analyze network traffic for unexpected connections from PowerJob servers to external destinations

Monitoring Recommendations

• Enable detailed access logging for all OpenAPI endpoints, particularly /openApi/addWorkflowNode
• Configure alerting for requests containing suspicious Groovy code patterns or shell command strings
• Monitor JVM process activity for unusual system calls or file system operations
• Review workflow node configurations regularly for unexpected or unauthorized entries

How to Mitigate CVE-2026-5739

Immediate Actions Required

• Restrict network access to the PowerJob OpenAPI endpoints using firewall rules or network segmentation
• Implement authentication and authorization controls for the /openApi/addWorkflowNode endpoint if not already present
• Consider temporarily disabling the affected OpenAPI endpoint until a patch is available
• Deploy a web application firewall with rules to block Groovy code injection patterns

Patch Information

As of the last update on 2026-04-08, no official patch has been released by the PowerJob project. The vulnerability was reported through GitHub Issue #1168, but the project has not yet responded. Organizations should monitor the PowerJob GitHub repository for security updates and patch releases.

Additional technical details are available through VulDB Vulnerability #355747.

Workarounds

• Implement network-level access controls to restrict access to the OpenAPI endpoints to trusted IP addresses only
• Deploy a reverse proxy or WAF in front of PowerJob to filter and sanitize incoming requests for malicious Groovy code patterns
• If workflow functionality is not required, consider disabling the Groovy evaluation feature or the entire OpenAPI component
• Implement application-level input validation to reject nodeParams values containing dangerous Groovy constructs

# Example: Restrict access to OpenAPI endpoints using iptables
# Allow only trusted management network to access PowerJob OpenAPI
iptables -A INPUT -p tcp --dport 7700 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7700 -j DROP