{"id":"CVE-2026-57294","aliases":["EUVD-2026-38775","GHSA-9v77-j4xv-34gq"],"status":"published","title":"Jenkins EC2 Fleet Plugin has a missing permission check","description":"A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00254,"percentile":0.1715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-06-24T13:20:12Z","modified":"2026-10-25T22:10:00Z","fixes":[{"ecosystem":"Maven","package":"com.amazon.jenkins.fleet:ec2-fleet","fixed_in":["4.2.3.540.va"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.amazon.jenkins.fleet:ec2-fleet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3.540.va"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.amazon.jenkins.fleet:ec2-fleet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3.540.va"}]}],"versions":["1.0","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.10.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.16.1","1.16.2","1.17.0","1.17.1","1.17.2","1.17.3","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.9.0","1.9.1","1.9.2","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.4.0","2.4.1","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.7.0","2.7.1","3.0.0","3.0.1","3.0.2","3.1.0","3.2.0","4.0.0.502.v329a_307d2a_5d","4.1.0.506.v619d63b_ec9d8","4.1.0.509.vfeb_109946260","4.1.1.510.v0b_8363265374","4.2.0.513.v46b_5d5cd156c","4.2.1.515.v100267825939","4.2.2.527.v38a_8758950a_0","4.2.3.539.v8fedff2a_81c3"]}],"products":[{"vendor":"jenkins","product":"ec2_fleet"},{"vendor":"jenkins project","product":"jenkins ec2 fleet plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774","tags":["vendor-advisory","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57294","tags":["advisory"]},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/pull/531","tags":["web"]},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/commit/a6eedb7bc112de92bbba179c03840d845b845c82","tags":["web"]},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/releases/tag/4.2.3.540.va_6eedb_7b_c112","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9v77-j4xv-34gq"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-57294","description":"A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.","status":"published","published":"2026-06-24T13:20:12.199Z","modified":"2026-06-24T14:46:33.242Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-38775","description":"A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.","status":"published","published":"2026-06-24T13:20:12Z","modified":"2026-06-24T14:46:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:30.642628Z"}],"ghsa":[{"id":"GHSA-9v77-j4xv-34gq","title":"Jenkins EC2 Fleet Plugin has a missing permission check","description":"Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nEC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.","status":"published","published":"2026-06-24T15:31:47Z","modified":"2026-09-25T19:03:01Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-57294","description":"A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.","status":"published","published":"2026-06-24T14:17:35.613Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"GHSA-9v77-j4xv-34gq","title":"Jenkins EC2 Fleet Plugin has a missing permission check","description":"Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nEC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.","status":"published","published":"2026-06-24T15:31:47Z","modified":"2026-09-25T19:15:04.531821831Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}