GitHub Advisoryadvisory · Maven

GHSA-9v77-j4xv-34gq Jenkins EC2 Fleet Plugin has a missing permission check

MEDIUM Published 2026-06-24 Modified 2026-09-25 Official page ↗
Aliases
CVE-2026-57294
Ecosystem
Maven
Packages
com.amazon.jenkins.fleet:ec2-fleet
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-09-25

Affected packages

• Maven com.amazon.jenkins.fleet:ec2-fleet: < 4.2.3.540.va → fixed in 4.2.3.540.va

Description

Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. EC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.

Related

Alias · CVE (1)

  • CVE-2026-57294 A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References