{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://quench-works.com/vex/jenkins-inbound-agent/2026-09-17",
  "author": "QuenchWorks <info@quench-works.com>",
  "timestamp": "2026-09-17T09:33:07.871271Z",
  "version": 3,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2025-48924"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): org.apache.commons/commons-lang3. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-47065"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): Apache MINA. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. Wolfi records this advisory against the package ORIGIN `jenkins-2` (verified in https://packages.wolfi.dev/os/security.json), and Trivy inherits it onto every jenkins-2 subpackage -- jenkins-docker-agent-openjdk-21, jenkins-remoting, jenkins-utils -- even though the vulnerable library ships only in the Jenkins CONTROLLER (jenkins.war): jackson-databind. This is the Jenkins INBOUND AGENT image, which contains no controller and no such library. Re-verified 2026-08-27 by full-layer extraction of the built image: the only jars present are remoting-3355.v388858a_47b_33.jar (with the agent.jar/slave.jar symlinks) and the JDK's jrt-fs.jar; `unzip -l` over both plus a raw byte grep of every other file in the layer return 0 matches for com/fasterxml/jackson, org/apache/mina, org/apache/sshd, org/apache/commons/lang3 and org/springframework. The vulnerable code is not present, so the finding is not exploitable here. (Secondary evidence that the advisory is mis-keyed: its fixed-version does not exist for origin jenkins-2, which Wolfi caps at 2.566-r1 -- 2.572/2.574/2.577/2.579 are published only under the separate o:jenkins-docker controller origin.)"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-docker-agent-openjdk-21"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-remoting"
        },
        {
          "@id": "pkg:apk/wolfi/jenkins-utils"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive. These advisories are Wolfi apk secdb entries keyed to the shared package origin 'o:jenkins-2' and are inherited by every jenkins-2 subpackage (jenkins-docker-agent, jenkins-remoting, jenkins-utils) from the Jenkins CONTROLLER (jenkins.war), where the vulnerable libraries actually live (jackson-databind, Apache MINA/sshd, Spring Security, and Jenkins core for CVE-2026-2332). This is the Jenkins INBOUND AGENT image, which does NOT ship the controller or any of those libraries. Verified by full-layer extraction: the image ships only remoting-*.jar (with agent.jar/slave.jar symlinks) plus the JDK's jrt-fs.jar; a grep for jackson/databind/mina/sshd/springframework across every layer returns 0 matches. The vulnerable code is not present in this image, so the reported CVEs are not exploitable here."
    }
  ]
}