CVE-2022-20620: Jenkins SSH Agent

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

• Jenkins SSH Agent: up to and including 1.23

Published 2022-01-12. Last modified 2026-06-17.