SSH Host Key Vulnerability in Jenkins Docker Images by Jenkins

CVE-2025-32755

What is CVE-2025-32755?

In Jenkins/SSH-Slave Docker images built on Debian, the SSH host keys are generated at the time of image creation. This results in all containers derived from these images sharing the same SSH host keys. As a consequence, an attacker with access to the network can position themselves between the SSH client (usually the Jenkins controller) and the SSH build agent, enabling them to impersonate the build agent, potentially leading to unauthorized access and control.

References