The Jenkins project issued a new security advisory for vulnerabilities affecting its Docker’s image deliverables, including jenkins/ssh-agent and the deprecated jenkins/ssh-slave.

Vulnerability Details

The advisory outlines a medium-severity vulnerability (CVSS) related to host key reuse in SSH build agent Docker images, which may allow attackers to impersonate Jenkins SSH build agents under some conditions. This issue has been tracked as:

This issue stems from SSH host keys being generated while Docker image creates Debian-based images. This means all containers built from the same image has identical SSH host keys, enabling man-in-the-middle (MitM) attacks. Attackers could exploit this to intercept or spoof connections between controller and agents.

Impact

CVE-2025-32754 and CVE-2025-32755 affects the Docker images that are based on Debian. This include

CVE-2025-32754 (jenkins/ssh-agent)

  • All versions not explicitly specifying an OS, including all –jdk*nand -jdk*-preview variants created before April 10, 2025.
  • All variants containing debian, stretch, bullseye, or bookworm created before April 10, 2025.

CVE-2025-32755 (jenkins/ssh-slave)

Tags with latest, jdk11, latest-jdk11, and revert-22-jdk11-JENKINS-52279.

Unaffected image variants include those based on Alpine, Nanoserver, or Windows for jenkins/ssh-agent, and the alpine tag for jenkins/ssh-slave.

Mitigation

The issue has been resolved in jenkins/ssh-agent version 6.11.2, which ensures SSH host keys are no longer created at build time. Instead, they are generated anew when the container is started for the first time.

It’s important to note that CVE-2025-32755(jenkins/ssh-slave)is deprecated and will not receive a fix. Jenkins strongly encourage users to transition to the jenkins/ssh-agent image for future deployments.

Users relying on affected Docker images should immediately:

  • Update to jenkins/ssh-agent version 6.11.2 or later.
  • Discontinue use of jenkins/ssh-slave and migrate to the supported jenkins/ssh-agent alternative.

Follow us on X and Linkedin for the latest cybersecurity news