EUVD-2026-38775
GHSA-9v77-j4xv-34gq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L confirmed by Overall/Read requirement; I:N because the flaw captures credentials but does not modify Jenkins data; C:L scoped to the Jenkins component.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
AnalysisAI
Missing permission check in Jenkins EC2 Fleet Plugin versions up to 4.2.3.539.v8fedff2a_81c3 enables any authenticated user holding the low-privilege Overall/Read role to trigger a credential-capture attack by directing the plugin to connect to an attacker-controlled endpoint and transmitting AWS credentials stored in Jenkins. The attacker must independently obtain a valid credential ID before exploiting this flaw, making it a chained attack rather than a direct standalone exploit. No public exploit code has been identified at time of analysis and CISA has not added this to the KEV catalog; SSVC rates exploitation status as none.
Technical ContextAI
The Jenkins EC2 Fleet Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_ec2_fleet_plugin:*:*:*:*:*:*:*:*) extends Jenkins CI/CD with the ability to dynamically provision Amazon EC2 Fleet instances as build agents. The root cause is CWE-862 (Missing Authorization): a plugin-exposed server-side action - likely a connectivity-test endpoint used to validate EC2 Fleet configuration - fails to verify that the requesting user holds any permission beyond the baseline Overall/Read role before executing the operation. Jenkins implements a granular permission model where Overall/Read is the minimum level granted to any authenticated user. By omitting an appropriate permission gate (such as requiring Overall/Administer or a plugin-specific credential-access permission), the plugin allows low-privileged users to trigger an outbound HTTP connection carrying AWS credentials (stored as Jenkins secrets or username/password credential entries) to an arbitrary URL of the attacker's choosing.
RemediationAI
The primary remediation is to upgrade the Jenkins EC2 Fleet Plugin to the version released in response to SECURITY-3774 as documented in the Jenkins Security Advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774. The exact patched version number is not confirmed in available input data - consult the advisory directly for the specific fixed release before upgrading. As an immediate compensating control prior to patching, administrators should audit and minimize the set of users holding Overall/Read permission, restricting it to trusted personnel; be aware this may affect legitimate read-only dashboard or monitoring access. Additionally, any AWS credentials stored in the Jenkins credential store - particularly those bound to EC2 Fleet configurations - should be rotated proactively if there is reason to suspect credential IDs have been exposed through enumeration or another vulnerability. Consider enabling Jenkins audit logging to detect unexpected connectivity-test invocations from low-privilege accounts as a detection mechanism.
More in Jenkins Ec2 Fleet Plugin
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today