CVE-2019-10364: Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.

Security readout for executives and security teams

Older Jenkins Amazon EC2 Plugin versions logged the beginning of private keys into the Jenkins system log. This is a credential exposure issue: anyone with access to those logs may see sensitive key material. Business urgency depends on whether affected plugin versions are still deployed and how broadly Jenkins logs are retained or shared. Exposure is likely limited to Jenkins environments running Amazon EC2 Plugin 1.43 or earlier with private keys configured and system logs accessible, exported, backed up, or aggregated. Prioritize discovery and remediation where Jenkins provisions EC2 resources or logs are broadly accessible. This is not proven actively exploited in the supplied sources, but leaked credential material in CI infrastructure can create cloud access risk. Mitigation focus: Identify Jenkins instances using Amazon EC2 Plugin 1.43 or earlier.; Check Jenkins vendor advisory for the fixed or recommended plugin version.; Upgrade the Amazon EC2 Plugin according to Jenkins guidance..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.