CVE-2026-57294 Details
Description
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
A vulnerability in the Jenkins EC2 Fleet Plugin, specifically in versions through 4.2.3.539.v8fedff2a_81c3, allows attackers with Overall/Read permission to capture AWS credentials stored in Jenkins. This is achieved by connecting to an attacker-specified URL using credentials IDs obtained through other means. The vulnerability arises from a missing permission check in several HTTP endpoints used for validating cloud configurations, which also do not require POST requests, creating a cross-site request forgery (CSRF) vulnerability.
Users of the EC2 Fleet Plugin should update to version 4.2.3.540.va_6eedb_7b_c112, which requires Overall/Administer permission and POST requests to perform the affected form validation actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins ec2 fleet | <= 4.2.3.539.v8fedff2a_81c3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |