Important
About the CVE-2026-123158 on Alpine Linx, aka. "SSHhole"
The Jenkins Docker SSH agent does NOT allow exploitation with their default sshd configuration which disables password authentication.
However, we shipped this new release (9.4.0) which ships the fixed OpenSSH version (openssh-10.3_p1-r2) in Alpine Linux to protect users which setup overrides the default /etc/sshd_config we provide.
Ref. https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
📦 Dependency updates
- Bump Debian Trixie Linux version to trixie-20261104 (#753) @github-actions[bot], @dduportal