CVE-2022-36881 Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

What is CVE-2022-36881?

CVE-2022-36881 is a high-severity vulnerability in Jenkins Git client Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

Weakness: CWE-295

Which versions are affected by CVE-2022-36881?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:git-client. It affects 1 product.

Products include Jenkins Git Client.

How do I fix CVE-2022-36881?

Upgrade org.jenkins-ci.plugins:git-client to 3.11.1 or later.

Is CVE-2022-36881 being exploited?

There is no known exploitation of CVE-2022-36881 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Git client Plugin

• CVE-2019-10392 Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin High 8.8
• CVE-2026-57282 Jenkins Git client Plugin has an OS command injection vulnerability on agents Medium 5.0
• CVE-2025-67640 Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin Medium 5.0
• CVE-2025-58458 Jenkins Git client Plugin file system information disclosure vulnerability Medium 4.3
• CVE-2017-1000242 Insecure temporary file usage in Jenkins Git Client Plugin Low 3.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cm7j-p8hc-97vj, RHSA-2022:7865.