Back to overview

CVE-2026-57294

Description
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

Metadata

CVE ID
CVE-2026-57294
State
PUBLISHED
Assigner
jenkins
Reserved
2026-06-24 08:41 UTC
Published
2026-06-24 13:20 UTC
Last updated
2026-06-24 13:20 UTC
Vendor / Product
Jenkins Project / Jenkins EC2 Fleet Plugin
Sources
cve.org  ·  NVD

Severity & Metrics

No CVSS data available.

Affected products (1)
VendorProductPlatformVersions
Jenkins Project Jenkins EC2 Fleet Plugin — 0 ≤ 4.2.3.539.v8fedff2a_81c3
References (1)
Back to overview