CVE-2026-57294: 
Jenkins vulnerability analysis and mitigation

CVE-2026-57294 is a missing permission check vulnerability in the Jenkins EC2 Fleet Plugin that allows low-privileged attackers to capture AWS credentials stored in Jenkins. It affects EC2 Fleet Plugin versions up to and including 4.2.3.539.v8fedff2a_81c3 and was disclosed on June 24, 2026, as part of the Jenkins Security Advisory SECURITY-3774. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (Jenkins Advisory, GitHub Advisory). It was reported by dyingman1 (redpoc Offensive Security Team) (Jenkins Advisory).

The root cause is CWE-862 (Missing Authorization): the EC2 Fleet Plugin fails to perform permission checks in several HTTP endpoints used to validate cloud configurations (GitHub Advisory). An attacker with only Overall/Read permission can send requests to these form validation endpoints, supplying an attacker-controlled URL and credential IDs obtained through a separate method, causing the Jenkins server to connect to the attacker's URL and transmit the referenced AWS credentials (Jenkins Advisory). A companion vulnerability, CVE-2026-57295, covers the CSRF aspect of the same endpoints, which accept GET requests and thus do not require POST, enabling cross-site request forgery attacks (Jenkins Advisory).

Successful exploitation allows an attacker with minimal Jenkins access (Overall/Read) to exfiltrate AWS credentials stored in Jenkins by causing the server to make an outbound connection to an attacker-controlled endpoint. Captured AWS credentials could then be used to access, modify, or destroy cloud resources in the victim's AWS environment, potentially enabling lateral movement into cloud infrastructure, data exfiltration, or resource abuse. There is no availability impact, but both confidentiality and integrity are partially affected (Jenkins Advisory, GitHub Advisory).

1. Reconnaissance: Identify a Jenkins instance running EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 or earlier. Obtain a low-privileged account with at least Overall/Read permission.
2. Enumerate credential IDs: Use a separate method (e.g., another information-disclosure vulnerability or social engineering) to obtain valid AWS credential IDs stored in Jenkins.
3. Set up a listener: Stand up an attacker-controlled HTTP server (e.g., using nc -lvp 8080 or Burp Collaborator) to capture incoming connections and credential data.
4. Craft malicious request: Send an HTTP GET request to one of the vulnerable EC2 Fleet Plugin form validation endpoints, supplying the attacker-controlled URL and the obtained credential ID as parameters — no POST or CSRF token is required due to the companion CSRF flaw (CVE-2026-57295).
5. Capture AWS credentials: The Jenkins server connects to the attacker's URL, transmitting the referenced AWS credentials, which are captured by the attacker's listener.
6. Abuse captured credentials: Use the harvested AWS credentials to authenticate to AWS services and perform unauthorized actions such as data exfiltration, resource manipulation, or lateral movement within the cloud environment (Jenkins Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the Jenkins controller to unknown or external IP addresses, particularly originating from EC2 Fleet Plugin form validation actions.
• Logs: Jenkins access logs showing GET requests to EC2 Fleet Plugin form validation endpoints (e.g., paths under /descriptorByName/com.amazon.jenkins.ec2_fleet.*) from low-privileged user accounts; requests with unusual or external url parameters.
• Logs: Jenkins system logs recording connection attempts to unrecognized AWS endpoints or non-AWS URLs using stored credential IDs.
• Behavior: AWS CloudTrail logs showing API calls using Jenkins-associated IAM credentials from unexpected IP addresses or at unusual times, which may indicate captured credentials are being used externally.

Update the Jenkins EC2 Fleet Plugin to version 4.2.3.540.va_6eedb_7b_c112 or later, which requires Overall/Administer permission and POST requests for the affected form validation endpoints (Jenkins Advisory). If an immediate upgrade is not possible, restrict Overall/Read access to trusted users only and monitor Jenkins for unexpected outbound connections. Additionally, rotate any AWS credentials stored in Jenkins as a precautionary measure if exposure is suspected.

The vulnerability was disclosed as part of a broad Jenkins security advisory on June 24, 2026, covering over 20 vulnerabilities across multiple plugins. Coverage appeared on security aggregation sites including CyberPress and various CVE tracking platforms shortly after disclosure (Feedly). No notable individual researcher commentary or significant social media discussion specific to CVE-2026-57294 has been identified beyond standard advisory republication.