CVE-2026-57295

The Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier are vulnerable to a cross-site request forgery (CSRF) and missing permission checks in several HTTP endpoints used to validate cloud configurations. Attackers with Overall/Read permission can leverage this to connect to an...

CVE-2026-57294

The Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier is vulnerable to a missing permission check in several HTTP endpoints used to validate cloud configurations. This flaw allows attackers with Overall/Read permission to connect to an attacker-specified URL using credentials ...