CVE-2022-25186: Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

The vulnerability stems from agent processes being able to directly request Vault secrets. Jenkins plugins typically implement agent-controller communication via RPC, where agent-side stubs call controller-side methods. The advisory indicates the patched version removed this functionality, suggesting the vulnerable functions were controller-side secret retrieval methods that: 1) Accepted arbitrary path/key parameters from agents 2) Lacked proper authorization checks 3) Were part of the Vault integration logic. The high-confidence entry reflects core secret retrieval plumbing, while the medium-confidence entry represents a deeper implementation detail inferred from typical plugin architecture.