The PowerJob Worker component, versions 5.1.2 and earlier, includes a /worker/deployContainer HTTP endpoint that is exposed without any authentication or access controls. An attacker who can reach the default transport port can invoke this endpoint and supply arbitrary container deployment commands, which the worker then executes. This flaw leads to remote code execution, allowing the attacker to gain full control over the underlying system. The lack of authentication means the vulnerability is exploitable from any location that can reach the service. The CVSS base score of 9.8 reflects the critical confidentiality, integrity, and availability impact. This vulnerability is classified as CWE-306.

The affected product is the PowerJob Worker component, specifically version 5.1.2 and all prior releases that have not yet been patched. No other product variants are documented. The vulnerability is linked to the default HTTP transport port used by PowerJob Worker.

Given the absence of authentication, a remote attacker who can access the default port can exploit the flaw immediately by sending an HTTP request to /worker/deployContainer with a malicious payload. The CVSS score of 9.8 signals maximum severity. EPSS is currently not available, so the exact exploitation likelihood cannot be quantified, but the combination of open port, unauthenticated endpoint, and powerful RCE capability suggests a high risk in any environment where the service is exposed to untrusted networks. The vulnerability is not listed in the CISA KEV catalog at this time, though its critical nature warrants immediate remedial action.