CVE-2026-82630: Server-Side Request Forgery in PowerJob

CVE-2026-82630 is a server-side request forgery vulnerability affecting PowerJob up to version 5.1.2. The flaw exists in the MuConnectionManager.getOrCreateConnection function located in the powerjob-server-starter module's TestController.java file. An attacker can remotely manipulate this function to induce the server to make unauthorized requests, potentially leading to information disclosure or interaction with internal systems. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and does not require privileges or user interaction to exploit. Although public exploit code is available, the vendor has not yet provided a patch or official remediation.

Successful exploitation allows a remote attacker to perform server-side request forgery, potentially enabling unauthorized internal network scanning or access to internal resources through the vulnerable server. The vulnerability does not require authentication or user interaction, increasing its risk. However, no known active exploitation in the wild has been reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As of now, the vendor has not responded or released a fix. Users should monitor official PowerJob channels for updates and consider applying network-level restrictions to limit the server's ability to make arbitrary outbound requests as a temporary mitigation.