CVE-2026-57294Medium· 5.4▾ SunlitJenkins EC2 Fleet Plugin has a missing permission check
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
EC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112 requires Overall/Administer permission and POST requests to perform these form validation actions.
com.amazon.jenkins.fleet:ec2-fleet < 4.2.3.540.vaUpgrade to a patched release:
com.amazon.jenkins.fleet:ec2-fleet 4.2.3.540.vaConnected by shared product, vendor, weakness, or advisory.
CVE-2026-57295Medium· 5.4Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
CVE-2026-112380Critical· 9.9Missing authorization in the WhatsApp channel in Kiro Crew
CVE-2026-35561High· 7.4Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
CVE-2026-94384High· 8.1Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM…
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0