CVE-2022-27198: Jenkins Cloudbees Aws Credentials

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Affected products

• Jenkins Cloudbees Aws Credentials: up to and including 189.v3551d5642995; from 1.28, before 1.28.2 (fixed in 1.28.2); version 1.32 only

Published 2022-03-15. Last modified 2026-06-17.