CVE-2025-32755 Weak cryptography in Jenkins jenkins/ssh-slave Docker images
Attackers can impersonate Jenkins build agents via Man-in-the-Middle attacks because Docker images share identical SSH host keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32755?
CVE-2025-32755 is a critical vulnerability in Jenkins jenkins/ssh-slave Docker images, published on 10 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
Weakness: CWE-338
Which versions are affected by CVE-2025-32755?
It affects 1 product.
Products include Jenkins Ssh-Slave.
How do I fix CVE-2025-32755?
No fix has been published for CVE-2025-32755 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32755 being exploited?
There is no known exploitation of CVE-2025-32755 in the wild and no public exploit code.
Sources
Also known as GHSA-rxr3-qrg9-4xg5.