CVE-2026-57295

Analyzed Analyzed - Analysis Complete

CSRF in Jenkins EC2 Fleet Plugin Allows AWS Credential Theft

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57295

EUVD

EUVD-2026-38776

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	ec2_fleet	to 4.2.3.539.v8fedff2a_81c3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) issue found in the Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier. It allows attackers to exploit the plugin by making Jenkins connect to a URL specified by the attacker using credentials IDs that the attacker has obtained through other means. This enables the attacker to capture AWS credentials stored within Jenkins.

Impact Analysis

The impact of this vulnerability is that an attacker can gain unauthorized access to AWS credentials stored in Jenkins. This can lead to unauthorized actions within your AWS environment, such as accessing, modifying, or deleting resources, potentially causing data breaches, service disruptions, or financial loss.

Compliance Impact

This vulnerability allows attackers to capture AWS credentials stored in Jenkins by exploiting a cross-site request forgery (CSRF) flaw in the Jenkins EC2 Fleet Plugin. Unauthorized access to such credentials can lead to data breaches or unauthorized data access.

Compromise of AWS credentials may result in violations of data protection regulations such as GDPR or HIPAA, as sensitive personal or health information stored or processed in AWS environments could be exposed or accessed without authorization.

Therefore, this vulnerability can negatively impact compliance with common standards and regulations by increasing the risk of unauthorized data access and potential data breaches.

Hi! I’m here to help you understand CVE-2026-57295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70