SSRF Vulnerability in PowerJob Transport Endpoint

A server-side request forgery (SSRF) vulnerability, assigned CVE-2026-82630, exists in PowerJob versions up to and including 5.1.2. The flaw is located in the MuConnectionManager.getOrCreateConnection function within the TestController.java file of the transport endpoint component. This vulnerability allows an unauthenticated remote attacker to manipulate network connections and force the PowerJob server to perform requests to internal or external network resources. Given the availability of public exploit material, there is a risk of unauthorized data access or interaction with internal services hosted within the same network as the PowerJob instance. The project maintainers have not yet provided a patch or formal response to the reported issue.

Impact

Successful exploitation allows remote attackers to perform SSRF attacks, potentially leading to unauthorized access to internal services, metadata services, or sensitive data within the server's network perimeter. The scope of impact depends on the internal network architecture of the affected organization.

Recommendation

• Monitor webserver access logs for anomalous requests to the TestController endpoint that deviate from baseline traffic patterns.
• Implement strict network egress filtering on the host running the PowerJob server to prevent unauthorized internal scanning or data exfiltration via SSRF.
• Evaluate the necessity of exposing the PowerJob instance to untrusted networks; restrict access using VPN or firewall rules until a security update is released.
• Monitor for any evidence of unauthorized requests sourced from the PowerJob server internal network segment.