Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log

MEDIUM 6.5CVE-2018-1999036 · GHSA-wwgx-94v6-fc2p · Published 01/08/2018 · updated 17/06/2026

In short

CVE-2018-1999036 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:ssh-agent, ssh agent (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.1% of all vulnerabilities.
Fix: update to 1.16 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:ssh-agent Maven	`< 1.16`	`1.16`
ssh agent jenkins	`≤ 1.15`	No fix yet

Description

An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log. As of version 1.16, the plugin no longer logs the ssh-add invocation that would reveal the passphrase.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1999036 · ADVISORY
jenkinsci/ssh-agent-plugin commit 3a8abe1 · WEB
jenkinsci/ssh-agent-plugin · PACKAGE
jenkins.io/security/advisory/2018-07-30 · WEB

More vulnerabilities in org.jenkins-ci.plugins:ssh-agent

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:ssh-agent

Maven

< 1.16

1.16

ssh agent

jenkins

≤ 1.15

No fix yet

Description

NVD description