CVE-2025-32754

CVE-2025-32754 is a critical vulnerability affecting jenkins/ssh-agent Docker images version 6.11.1 and earlier. It stems from the generation of identical SSH host keys during image creation for Debian-based images, leading to all containers from the same image version sharing these keys. This allows an attacker to perform a man-in-the-middle attack, impersonating an SSH build agent to the Jenkins controller. With a CVSS score of 9.1 (CRITICAL), this vulnerability has a network attack vector and low attack complexity, potentially leading to high confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.