{"id":"CVE-2026-57295","aliases":["GHSA-2x9c-vp3g-hvv2"],"title":"Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability","summary":"Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability","severity":"medium","cvss":5.4,"cwe":["CWE-352"],"vendor":"amazon","product":"com.amazon.jenkins.fleet:ec2-fleet","ecosystem":"maven","affected":["com.amazon.jenkins.fleet:ec2-fleet < 4.2.3.540.va"],"patched":["com.amazon.jenkins.fleet:ec2-fleet 4.2.3.540.va"],"published":"2026-06-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T19:02:11Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2x9c-vp3g-hvv2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57295"},{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/pull/531"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/commit/a6eedb7bc112de92bbba179c03840d845b845c82"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/releases/tag/4.2.3.540.va_6eedb_7b_c112"},{"url":"https://github.com/advisories/GHSA-2x9c-vp3g-hvv2"}],"tags":["ghsa","maven"],"epss":0.00221,"epssPercentile":0.11237,"ingestedAt":"2026-09-25T19:15:38.961Z","slug":"CVE-2026-57295","body":"## Overview\n\nJenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nEC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.\n\n## Affected packages\n\n- `com.amazon.jenkins.fleet:ec2-fleet < 4.2.3.540.va`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `com.amazon.jenkins.fleet:ec2-fleet 4.2.3.540.va`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}