Skip to content
Sign in
5.4 Medium

CVE-2026-57295 A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier…

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins EC2 Fleet Plugin Versions not published

Other CVEs of Jenkins EC2 Fleet Plugin

The 2 CVEs of Jenkins EC2 Fleet Plugin →
CVE-2026-57294 A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with… 5.4 Medium
Track this CVE