CVE-2026-57295: Jenkins EC2 Fleet Plugin CSRF Vulnerability – AWS Credential Exposure

Technical summary

The vulnerability is a classic CSRF issue (CWE-352) in the Jenkins EC2 Fleet Plugin. An authenticated attacker can craft a malicious request that, when visited by a Jenkins administrator or user with plugin configuration permissions, causes Jenkins to initiate a connection to an attacker-specified URL using attacker-selected credential IDs from Jenkins' credential store. Because the plugin does not properly validate the origin of configuration requests, the attacker can exfiltrate or intercept AWS credentials during this forced connection. The attack requires prior knowledge of valid credential IDs within the target Jenkins instance, typically obtained through reconnaissance or a separate vulnerability.

Business impact

Exposure of AWS credentials stored in Jenkins represents a critical business risk. Compromised cloud credentials grant attackers direct access to AWS resources, including compute instances, storage buckets, databases, and networking infrastructure. An attacker with these credentials can launch additional attacks, exfiltrate data, modify or delete cloud resources, establish persistence, or incur significant costs through resource abuse. For organizations running EC2 Fleet automation through Jenkins, this vulnerability bridges the gap between Jenkins compromise and full AWS infrastructure compromise.

Affected systems

Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and all earlier versions are affected. Any Jenkins instance with this plugin installed and configured with AWS credentials is at risk, particularly those where multiple users have access to Jenkins or where the instance is exposed to untrusted networks. The vulnerability requires an authenticated user (PR:L in the CVSS vector), so Jenkins instances with authentication enabled are the primary concern.

Exploitability

Exploitability is moderate. The attack requires an authenticated Jenkins user and low attack complexity, with no special user interaction beyond the attacker controlling the malicious request path. The attacker must already possess knowledge of valid credential IDs, which limits casual exploitation but is realistic in targeted attacks where reconnaissance has been performed. No network segmentation or specialized tools are required; a simple crafted HTTP request suffices. The vulnerability is not currently tracked as actively exploited in the wild (KEV status: not added).

Remediation

Upgrade Jenkins EC2 Fleet Plugin to a patched version released after 4.2.3.539.v8fedff2a_81c3. Verify the exact patched version against the official Jenkins plugin repository and vendor advisory. Additionally, implement defense-in-depth: restrict Jenkins access to trusted networks, enforce multi-factor authentication for Jenkins users, regularly audit credential usage, and consider using AWS IAM policies to limit the scope of credentials stored in Jenkins. Rotate all AWS credentials that may have been exposed if the system was suspected of compromise.

Patch guidance

Check the Jenkins EC2 Fleet Plugin update center or the official Jenkins plugin repository for versions released after June 2026 that address CVE-2026-57295. Apply the patch in a test environment first to verify compatibility with your Jenkins version and other plugins. Jenkins administrators should enable automatic plugin updates where possible to avoid missing critical patches. After patching, validate that EC2 Fleet automation continues to function correctly and that credential access controls are enforced.

Detection guidance

Monitor Jenkins audit logs for unusual configuration changes to EC2 Fleet Plugin settings, particularly modifications to credential IDs or endpoint URLs. Look for HTTP requests to EC2 Fleet Plugin configuration endpoints from unexpected IP addresses or user agents. Implement network monitoring to detect outbound connections from Jenkins to non-whitelisted AWS endpoints. Audit CloudTrail logs in AWS for API calls made with credentials that should only be used by Jenkins, looking for anomalous activity such as calls from unexpected IP addresses or at unusual times. Set up alerts for credential access events in Jenkins' credential audit log.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 5.4 (Medium) reflects the requirement for authentication and the limited information disclosure scope, but the business impact is significant due to credential exposure. Prioritize patching for Jenkins instances that store sensitive AWS credentials, are accessible to multiple users, or are exposed to networks with untrusted users. Instances isolated in air-gapped environments with single-user access present lower risk.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: Network-accessible attack vector (AV:N) because Jenkins is typically web-facing; Low attack complexity (AC:L) as no special conditions are needed; Low privilege requirement (PR:L) since any authenticated user can trigger the CSRF; No user interaction needed (UI:N) for the malicious request to execute; Unchanged scope (S:U) as the impact is confined to Jenkins and its stored credentials; Low confidentiality impact (C:L) from credential exposure; Low integrity impact (I:L) from potential credential misuse; and No availability impact (A:N). The score appropriately balances authentication requirements against the sensitive nature of the exposed credentials.

Frequently asked questions