CVE-2026-57294Medium· 5.4▾ SunlitJenkins EC2 Fleet Plugin has a missing permission check
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
EC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.
com.amazon.jenkins.fleet:ec2-fleet < 4.2.3.540.vaUpgrade to a patched release:
com.amazon.jenkins.fleet:ec2-fleet 4.2.3.540.vaConnected by shared product, vendor, weakness, or advisory.
CVE-2026-57295Medium· 5.4Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
CVE-2026-94384High· 8.1Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM…
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0
CVE-2026-11400High· 8.0AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
CVE-2026-11807Critical· 9.6A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API
CVE-2025-13772High· 7.1GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorize…