PT-2026-51804 · Jenkins · Ec2 Fleet Plugin
CVE-2026-57294
·
Published
2026-06-24
·
Updated
2026-06-24
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins EC2 Fleet Plugin versions prior to 4.2.3.539.v8fedff2a 81c3
Description
A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL. By using credentials IDs obtained through other means, an attacker can capture AWS credentials stored within Jenkins.
Recommendations
Update Jenkins EC2 Fleet Plugin to a version later than 4.2.3.539.v8fedff2a 81c3.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ec2 Fleet Plugin