The vulnerability arises from the Swarm Client's use of Apache Commons HttpClient 3.1's EasySSLProtocolSocketFactory, which lacks proper hostname verification. The key functions are: 1) The socket factory's createSocket method that implements the insecure validation, 2) The protocol registration that enables the vulnerable factory for HTTPS, and 3) The Swarm Client's HTTP client initialization that uses these components. These functions would appear in stack traces during SSL handshake and HTTP client setup when connecting to a Jenkins master, which is when MITM attacks would be triggered.