PowerJob Server-Side Request Forgery in Transport Endpoint

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PowerJob versions up to 5.1.2 contain a critical server-side request forgery (SSRF) vulnerability in the TestController's MuConnectionManager.getOrCreateConnection function. This vulnerability allows remote attackers to manipulate the transport endpoint, enabling them to forge requests from the server to internal or external systems without authentication. Organizations running affected PowerJob deployments face significant risk, as attackers can leverage this flaw to access internal services, exfiltrate data, or pivot deeper into infrastructure. The vulnerability's public availability and active exploitation potential make immediate patching essential for any organization using PowerJob for job scheduling and workflow management.

Casky's 331 matching security skills leverage Claude's extended reasoning to detect the attack patterns associated with this SSRF vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners using Casky would observe detection signals tied to suspicious HTTP/HTTPS requests originating from PowerJob server processes attempting to connect to unexpected internal addresses, localhost ports, or cloud metadata endpoints. The platform's AI-driven analysis would correlate transport layer manipulation attempts with outbound connection anomalies, flagging requests to sensitive endpoints like database servers, internal APIs, or cloud service credentials. Security teams would also identify exploitation patterns in application logs showing unusual TestController invocations with manipulated connection parameters, enabling early intervention before attackers establish persistent access or compromise sensitive internal resources.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82630.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-82630

Casky has 331 skills that investigate the attack patterns behind CVE-2026-82630. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn