CVE-2026-57295

The Jenkins EC2 Fleet Plugin (version 4.2.3.539.v8fedff2a_81c3 and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is a missing permission check in several HTTP endpoints used for cloud configuration validation, combined with the fact that these endpoints do not...

CVE-2026-57294

The Jenkins EC2 Fleet Plugin (version 4.2.3.539.v8fedff2a_81c3 and earlier) is vulnerable to a missing authorization check in several HTTP endpoints used to validate cloud configurations. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using credentials ...