{"schema":"threatline.record/2","record":{"id":"CVE-2026-57294","aliases":["GHSA-9v77-j4xv-34gq"],"summary":"Jenkins EC2 Fleet Plugin has a missing permission check","details":"Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nEC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.","categories":["Applications & CMS"],"product":"com.amazon.jenkins.fleet:ec2-fleet","vendor":"Jenkins Project","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9v77-j4xv-34gq","source_modified_at":"2026-09-25T19:03:01Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.amazon.jenkins.fleet:ec2-fleet"},"range":"< 4.2.3.540.va"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57294","source_modified_at":"2026-06-24T14:46:33.242Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Jenkins EC2 Fleet Plugin","vendor":"Jenkins Project","versions":[{"version":"0","versionType":"maven","lessThanOrEqual":"4.2.3.539.v8fedff2a_81c3","status":"affected"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9v77-j4xv-34gq","source_modified_at":"2026-09-25T19:15:04.531821831Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.amazon.jenkins.fleet:ec2-fleet","purl":"pkg:maven/com.amazon.jenkins.fleet/ec2-fleet"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.2.3.540.va"}],"type":"ECOSYSTEM"}],"versions":["1.0","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.10.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.16.1","1.16.2","1.17.0","1.17.1","1.17.2","1.17.3","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.9.0","1.9.1","1.9.2","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9v77-j4xv-34gq","source_modified_at":"2026-09-25T19:03:01Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.amazon.jenkins.fleet:ec2-fleet"},"version":"4.2.3.540.va"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9v77-j4xv-34gq","source_modified_at":"2026-09-25T19:15:04.531821831Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.amazon.jenkins.fleet:ec2-fleet","purl":"pkg:maven/com.amazon.jenkins.fleet/ec2-fleet"},"version":"4.2.3.540.va"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00254,"percentile":0.1611,"score_date":"2026-10-23"},"published_at":"2026-06-24T13:20:12.199Z","modified_at":"2026-09-25T19:15:04.531821831Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9v77-j4xv-34gq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T19:03:01Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57294","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-06-24T14:46:33.242Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9v77-j4xv-34gq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T19:15:04.531821831Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57294","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57294","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774","tags":["vendor-advisory"]},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/pull/531","source":"GitHub Advisory Database"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/commit/a6eedb7bc112de92bbba179c03840d845b845c82","source":"GitHub Advisory Database"},{"url":"https://github.com/jenkinsci/ec2-fleet-plugin/releases/tag/4.2.3.540.va_6eedb_7b_c112","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-9v77-j4xv-34gq","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-06-24T14:46:30.569141Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T19:15:04.531821831Z","content_hash":"e155c008345407c74feac9d02d1bcb3882bf3c863c3bf8e2096458852566ad61"}}