CVE-2026-57295: 
Jenkins vulnerability analysis and mitigation

CVE-2026-57295 is a Cross-Site Request Forgery (CSRF) vulnerability in the Jenkins EC2 Fleet Plugin, tracked under security advisory SECURITY-3774. It affects EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier, allowing attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, thereby capturing AWS credentials stored in Jenkins. The vulnerability was disclosed on June 24, 2026, as part of a broader Jenkins security advisory. It carries a CVSS v3.1 base score of 5.4 (Medium) (Jenkins Advisory, GitHub Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the EC2 Fleet Plugin's HTTP endpoints used for cloud configuration validation do not require POST requests, making them accessible via GET and therefore susceptible to CSRF attacks. An attacker who has obtained valid credentials IDs through another method can craft a malicious request that, when triggered by an authenticated Jenkins user's browser, causes the plugin to connect to an attacker-controlled URL using those credentials, effectively exfiltrating AWS credentials. The companion vulnerability CVE-2026-57294 (missing permission check) compounds the risk by allowing attackers with only Overall/Read permission to reach these endpoints without proper authorization. The vulnerability was reported by dyingman1 (redpoc Offensive Security Team) (Jenkins Advisory).

Successful exploitation allows an attacker to capture AWS credentials stored in Jenkins by tricking an authenticated user into triggering a forged request to an attacker-controlled endpoint. The confidentiality and integrity impacts are both rated Low, with no availability impact, but the exposure of AWS credentials could enable significant downstream compromise of cloud infrastructure, including unauthorized access to EC2 resources, data exfiltration, or lateral movement within the AWS environment. The attack requires the attacker to have already obtained valid Jenkins credentials IDs through a separate method, limiting but not eliminating the practical risk (Jenkins Advisory, GitHub Advisory).

1. Reconnaissance: Identify a Jenkins instance running EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 or earlier. Confirm the plugin is installed and active via the Jenkins plugin manager page or by probing known plugin endpoints.
2. Obtain Credentials IDs: Use a separate vulnerability (e.g., CVE-2026-57294, the companion missing permission check) or social engineering to enumerate valid AWS credentials IDs stored in Jenkins.
3. Set up attacker-controlled server: Deploy a server at an attacker-controlled URL capable of logging incoming HTTP requests, including any AWS credential data transmitted by the Jenkins plugin during connection validation.
4. Craft CSRF payload: Construct a malicious HTML page or URL that, when loaded by an authenticated Jenkins user's browser, sends a GET request to the EC2 Fleet Plugin's form validation endpoint (e.g., /descriptorByName/com.amazon.jenkins.ec2_fleet.EC2FleetCloud/checkXxx) with the attacker-specified URL and credentials ID as parameters.
5. Deliver payload: Trick an authenticated Jenkins user (ideally with Overall/Read or higher permissions) into visiting the malicious page via phishing, a compromised web resource, or another social engineering vector.
6. Capture AWS credentials: The Jenkins server, acting on the forged request, connects to the attacker-controlled URL using the specified credentials, transmitting AWS credential data that the attacker's server logs for later use (Jenkins Advisory).

• Network: Outbound HTTP/HTTPS connections from the Jenkins server to unexpected or external URLs during EC2 Fleet plugin form validation operations; connections to non-AWS, non-internal endpoints from the Jenkins process.
• Logs: Jenkins access logs showing GET requests to EC2 Fleet Plugin form validation endpoints (e.g., paths containing ec2_fleet or EC2FleetCloud) with unusual or external URL parameters; requests originating from unexpected referrers or with no referrer header.
• Process/Behavior: Jenkins initiating connections to attacker-controlled infrastructure during cloud configuration validation steps, particularly outside of normal administrative activity windows.
• Credentials: Unexpected AWS API activity (e.g., new IAM sessions, unusual EC2 API calls) in CloudTrail logs that correlate with Jenkins plugin activity, potentially indicating captured credentials are being used (Jenkins Advisory).

Update the Jenkins EC2 Fleet Plugin to version 4.2.3.540.va_6eedb_7b_c112 or later, which enforces Overall/Administer permission and requires POST requests for all form validation endpoints, eliminating both the CSRF and missing permission check vulnerabilities. As an interim workaround, restrict Jenkins access to trusted users only and limit Overall/Read permissions to minimize the attacker's ability to reach vulnerable endpoints. Additionally, review and rotate any AWS credentials stored in Jenkins as a precaution if exposure is suspected (Jenkins Advisory).

The vulnerability was part of a large Jenkins security advisory on June 24, 2026, covering over 20 plugins, which received coverage from security news outlets including CyberPress. The reporter, dyingman1 of the redpoc Offensive Security Team, was credited for discovering multiple vulnerabilities in the same advisory batch. No significant independent researcher commentary or social media discussion specific to CVE-2026-57295 has been identified beyond standard vulnerability aggregator coverage (Jenkins Advisory).