CVE-2022-36881: Jenkins Git Client

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

Affected products

• Jenkins Git Client: up to and including 3.11.0

Published 2022-07-27. Last modified 2026-06-17.