VEXjenkins-inbound-agent
jenkins-inbound-agent
9 بيانات, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.
@id https://quench-works.com/vex/jenkins-inbound-agent/2026-09-17
CVE-2025-48924
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): org.apache.commons/commons-lang3. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)
CVE-2026-47065
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): Apache MINA. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)
CVE-2026-54512
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.
CVE-2026-54513
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.
CVE-2026-54514
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.
CVE-2026-54515
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): jackson-databind. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)
CVE-2026-54516
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.
CVE-2026-54517
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.
CVE-2026-54518
غير متأثر · الشيفرة المعرّضة غير موجودة- pkg:apk/wolfi/jenkins-docker-agent
- pkg:apk/wolfi/jenkins-docker-agent-openjdk-21
- pkg:apk/wolfi/jenkins-remoting
- pkg:apk/wolfi/jenkins-utils
PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here.