EUVD-2026-38776
GHSA-2x9c-vp3g-hvv2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CSRF inherently requires victim interaction so UI:R is correct; PR:L retained as attacker must separately obtain credentials IDs; no availability impact applies.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
AnalysisAI
Cross-site request forgery in Jenkins EC2 Fleet Plugin versions through 4.2.3.539.v8fedff2a_81c3 enables a network attacker to force Jenkins to connect to an attacker-controlled endpoint using AWS credentials stored in Jenkins, effectively exfiltrating those credentials. All Jenkins instances with this plugin installed and AWS credentials configured are at risk. No active exploitation is confirmed (not in CISA KEV), SSVC rates this as non-automatable with partial technical impact, and no public exploit code has been identified at time of analysis.
Technical ContextAI
The affected component is the Jenkins EC2 Fleet Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_ec2_fleet_plugin:*:*:*:*:*:*:*:*), a Jenkins CI/CD plugin that manages AWS EC2 Spot Fleet and On-Demand instances as dynamic build agents. The root cause is CWE-352 (Cross-Site Request Forgery): one or more plugin endpoints that initiate outbound connections to AWS-related URLs fail to validate that the incoming request originates from a legitimate Jenkins UI session rather than a forged cross-site request. Because Jenkins stores AWS credentials in its internal credential store and the plugin can reference them by credentials ID, an attacker who has separately obtained a valid credentials ID can craft a CSRF payload that instructs Jenkins to connect to an attacker-controlled URL, causing Jenkins to authenticate against that URL and thereby expose the AWS credentials to the attacker.
RemediationAI
Upgrade the Jenkins EC2 Fleet Plugin to a version released after 4.2.3.539.v8fedff2a_81c3 per the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774; the exact fixed version number is not independently confirmed from available data beyond that the advisory addresses this issue. As compensating controls pending upgrade: restrict Jenkins access to trusted internal networks or VPN to reduce exposure to external CSRF-originating pages, noting this does not eliminate risk from internal attackers. Audit and remove AWS credentials from the Jenkins credential store that are no longer required by the plugin, reducing blast radius if exploited. Verify that Jenkins' built-in CSRF protection is globally enabled in Manage Jenkins > Security > CSRF Protection, as disabling it would increase exposure. Rotating any AWS credentials stored in Jenkins is advisable if exposure is suspected.
More in Jenkins Ec2 Fleet Plugin
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today