Jenkins EC2 Fleet Plugin CVE-2026-57295

The attacker must independently obtain a valid Jenkins credentials ID before crafting the attack - this is not discoverable through the CSRF vector itself and requires a separate reconnaissance step (e.g., prior low-level access, credential ID enumeration, or insider knowledge). A Jenkins user who has access to the EC2 Fleet Plugin functionality must be tricked into triggering the forged request while holding an active authenticated session in their browser. The Jenkins EC2 Fleet Plugin must be installed on the target instance and AWS credentials must be stored within Jenkins' credential store and referenced by the plugin. Exploitation is not automatable per SSVC assessment. Instances without the plugin installed, without stored AWS credentials, or where Jenkins is restricted to internal networks with no external user-browsable content are substantially less exposed.

The provided CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) warrants scrutiny: the UI:N metric is anomalous for a CSRF vulnerability, which by definition requires a victim user to trigger the forged request - typical CSRF mappings use UI:R. This discrepancy should be verified against the Jenkins security advisory. SSVC assessment signals no current active exploitation, a non-automatable attack path (the attacker must separately obtain credentials IDs and then socially engineer a victim), and only partial technical impact. The absence of an EPSS score in available data means probabilistic exploitation likelihood cannot be quantified, but the SSVC 'exploitation: none' rating aligns with low near-term exploitation risk. Despite the medium CVSS, the real-world impact ceiling is meaningful: successful exploitation yields AWS credentials, which can enable broad lateral movement within an AWS environment. Risk is highest for organizations where Jenkins is internet-accessible and AWS credentials with broad IAM permissions are stored in the plugin.

An attacker who has enumerated a valid Jenkins credentials ID - for example, through a prior low-privilege access or insider knowledge - crafts a malicious webpage containing a hidden form or JavaScript that submits a request to the victim's Jenkins instance referencing the EC2 Fleet Plugin endpoint. When an authenticated Jenkins user with access to the plugin visits this page, the forged request is silently submitted under the victim's session, causing Jenkins to initiate a connection to an attacker-controlled server using the specified AWS credentials. The attacker's server logs the incoming authentication material, yielding the AWS credentials without the victim's awareness. No public exploit code is currently known.