[mjatin2007]

Require ADMINISTER for the SSH credential selector (doFillCredentialIdItems) and connection check (doLoginCheck), and require POST for the connection check. Non-administrator requests to both endpoints are rejected; GET requests to the connection check are also rejected. The global-configuration validate button sends POST with a crumb, preserving the administrator workflow.

This remediates already-public issues from the 2022-05-17 Jenkins security advisory:

• SECURITY-2093 (CVE-2022-30958, CVE-2022-30959; High), credited to Long Nguyen of Viettel Cyber Security
• SECURITY-2315 (CVE-2022-30957; Medium), credited to Wadeck Follonier of CloudBees, Inc.

Testing done

• New SSHBuildWrapperSecurityTest (6 tests): on exact unpatched base e44d09b, 4 fail (reader POST, reader GET, administrator GET, and reader credential-list access); with this change all 6 pass
• mvn -B -ntp verify: 23 tests passed with SpotBugs and Spotless clean on Java 21 and Maven 3.9.9
• UI compatibility checked against Jenkins core's validateButton POST/crumb path and an administrator POST-with-crumb test; no manual browser test was run

Submitter checklist

• Opening from topic branch security/ssh-endpoint-hardening, not master
• The title represents the desired changelog entry
• The change and compatibility behavior are described above
• Relevant Jenkins advisories are linked above
• No open competing security-fix PR was found as of 2026-11-03; #17 is unrelated host-management work with file-level overlap
• Automated regression tests demonstrate the fix