CVE-2025-32754 Weak cryptography in Jenkins jenkins/ssh-agent Docker images
Attackers can impersonate Jenkins SSH agents via network interception due to shared SSH host keys in Debian-based Docker images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32754?
CVE-2025-32754 is a critical vulnerability in Jenkins jenkins/ssh-agent Docker images, published on 10 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
Weakness: CWE-338
Which versions are affected by CVE-2025-32754?
It affects 1 product.
Products include Jenkins Ssh-Agent.
How do I fix CVE-2025-32754?
No fix has been published for CVE-2025-32754 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32754 being exploited?
There is no known exploitation of CVE-2025-32754 in the wild and no public exploit code.
Sources
Also known as GHSA-x97h-g784-4pw8.