CVE-2025-32754: Critical SSH Host Key Vulnerability in Jenkins/ssh-agent Docker Images

Overview

In the rapidly evolving world of cybersecurity, a newly discovered vulnerability, CVE-2025-32754, has raised alarms in the tech community. This vulnerability affects all Jenkins/ssh-agent Docker images version 6.11.1 and earlier, potentially leading to a system compromise or data leakage. The concern is even more significant given the widespread use of Docker in various industries and companies for app development and deployment. This vulnerability allows attackers who can insert themselves into the network path between the SSH client and the SSH build agent to impersonate the latter, creating a serious threat to the integrity and security of the system.

Vulnerability Summary

CVE ID: CVE-2025-32754
Severity: Critical, CVSS Score 9.1
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

Jenkins/ssh-agent Docker Images | 6.11.1 and earlier

How the Exploit Works

The vulnerability originates from the Docker image creation process. In the affected versions, SSH host keys are generated during the image creation for images based on Debian. This results in all containers based on images of the same version using the same SSH host keys. An attacker, who can insert themselves into the network path between the SSH client (typically the Jenkins controller) and the SSH build agent, can exploit this to impersonate the build agent. This impersonation can lead to unauthorized access and potential system compromise.

Conceptual Example Code

While the exploit does not directly involve an HTTP request, shell command, or pseudocode, a conceptual example would be an attacker leveraging the shared SSH host keys to establish an SSH connection with the Jenkins controller, impersonating the build agent:

ssh -i /path/to/shared/host/key jenkins_controller@target.example.com

In this command, the attacker uses the shared host key to authenticate themselves as the build agent to the Jenkins controller. Once authenticated, the attacker could execute commands with the same privileges as the build agent, potentially leading to system compromise or data leakage.
Please note, this is a conceptual example and the actual exploit might be much more complex and require a detailed understanding of the target system’s architecture and security mechanisms.