CVE-2023-37948: Jenkins Cloud Infrastructure Compute

Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attacks.

Affected products

• Jenkins Cloud Infrastructure Compute: before 1.0.17 (fixed in 1.0.17)

Published 2023-07-12. Last modified 2026-06-17.