Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@dns43 @PurdueEngineers @torresariass This isn't theoretical. Software Dark Matter led to 3 zero-days: a leaked GitHub push token baked into the popular https://bloom.bg/4ee6jMc Docker image (CVE-2025-32111) + static, reused SSH host keys in Jenkins' ssh-agent image (CVE-2025-32754/-32755) #SupplyChainSecurity (3/5) https://t.co/kU8G6D4Trz
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jenkins | ssh-agent | - | docker | - |