The Jenkins EC2 Fleet Plugin contains a cross‑site request forgery flaw that allows an attacker to send a crafted request to the plugin's endpoint. By supplying a credentials ID that the attacker already has access to, the plugin will connect to a URL specified by the attacker and can expose the AWS credentials stored in Jenkins. This flaw directly leads to credential theft and subsequent unauthorized access to AWS resources.

Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier.

The CVSS score is not provided and the EPSS score is unavailable, indicating that known exploitation is not widely documented. The vulnerability is a CSRF type, typically exploited by having a victim perform a privileged action in Jenkins without proper token validation. An attacker must already possess a valid credentials ID and drive a victim to submit a crafted request. The risk is contingent upon the presence of such IDs and the web access available to attacker; the flaw alone does not provide arbitrary code execution.