CVE-2026-57295: Jenkins EC2 Fleet Plugin CSRF in AWS credential connection

CVE-2026-57295 · Severity: medium · CVSS 5.4 · Published 2026-06-24

The Jenkins EC2 Fleet Plugin, which manages Amazon EC2 instances for build tasks, contains a security flaw that could allow an attacker to steal AWS credentials. By tricking a logged-in user into clicking a malicious link, an attacker can force the plugin to connect to a server they control. This allows the attacker to capture sensitive AWS authentication keys stored within the Jenkins system, potentially leading to unauthorized access to the organization's cloud infrastructure.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57295 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57295 being exploited in the wild.
How severe is CVE-2026-57295?
Medium severity, with a CVSS score of 5.4, published 24 June 2026.
Which products and versions are affected?
Jenkins Project EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier; com.amazon.jenkins.fleet:ec2-fleet (Maven) < 4.2.3.540.va, ECOSYSTEM:introduced=0,fixed=4.2.3.540.va.
Is there a fix for CVE-2026-57295?
Yes. com.amazon.jenkins.fleet:ec2-fleet (Maven): upgrade to 4.2.3.540.va or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57295 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57295?
Check whether you run Jenkins Project EC2 Fleet Plugin or com.amazon.jenkins.fleet:ec2-fleet (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.amazon.jenkins.fleet:ec2-fleet (Maven): upgrade to 4.2.3.540.va or later
    # set com.amazon.jenkins.fleet:ec2-fleet to 4.2.3.540.va in your pom.xml or build.gradle

Technical details

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier. The vulnerability resides in an HTTP endpoint that fails to implement proper CSRF protection, allowing an attacker to induce a victim to perform an action that connects Jenkins to an arbitrary URL. By specifying an attacker-controlled URL and a valid credentials ID (potentially obtained through other information disclosure vulnerabilities), the attacker can capture the AWS credentials associated with that ID when Jenkins attempts to authenticate against the malicious endpoint. This requires the attacker to successfully social engineer a user with sufficient permissions into visiting a malicious site or clicking a link while authenticated to Jenkins.

Affected products

  • Jenkins Project EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier

Identifiers

  • CVE-2026-57295
  • GHSA-2x9c-vp3g-hvv2

Timeline

  • 2026-06-24: disclosed: Initial advisory publication by Jenkins Project
  • 2026-06-24: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.