jenkins ssh agent vulnerabilities

Latest jenkins ssh agent CVEs

Newest publication first

1. CVE-2022-20620 Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs

   Published 2022-01-12

   Medium·CVSS 4.3 EPSS 0.77%

   Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

2. CVE-2018-1999036 Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log

   Published 2018-08-01

   Medium·CVSS 6.5 EPSS 1.4%

   An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.