Jenkins EC2 CVEs
10 CVEs, 1 protected by Waratek
Overview 10 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
1
10.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
90.0%
blocked by ARMR today
1
10.0%
partly blocked
0
0.0%
not blocked
9
90.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
10
100.0%
split by
peak 6 / year
20181
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
20191
No exploit published1
Medium1
not blocked1
No public exploit1
20206
No exploit published6
High2
Medium4
not blocked6
No public exploit6
20210
20220
20230
20240
20250
20262
No exploit published2
Medium2
not blocked2
No public exploit2
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-57295 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2026-57294 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2020-2188 | Medium | 2020-05-06 | No exploit published | No public exploit | A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. |
| CVE-2020-2187 | Medium | 2020-05-06 | No exploit published | No public exploit | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks. |
| CVE-2020-2186 | Medium | 2020-05-06 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. |
| CVE-2020-2185 | Medium | 2020-05-06 | No exploit published | No public exploit | Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. |
| CVE-2020-2091 | High | 2020-01-15 | No exploit published | No public exploit | A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. |
| CVE-2020-2090 | High | 2020-01-15 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. |
| CVE-2019-10364 | Medium | 2019-07-31 | No exploit published | No public exploit | Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. |
| CVE-2017-1000502 | High | 2018-01-24 | Protected by Waratek | No public exploit | Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators. |