Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud").
Meanwhile the corporate/customer/whatever network(s) have firewall ACLs permitting SSH traffic from the bastion/jump host to the internal SSH server(s).
Is it possible for an evil actor to exploit the jump host to enable viewing of SSH traffic ? Or is the traffic that flows over the jump host always end-to-end encrypted ? (i.e. the bastion/jump host always just sees an encrypted flow because the traffic between client and internal server uses the internal server's keypair).
For the avoidance of doubt over terminology, when I talk about jump host I'm talking about commands such as :
ssh -J bastion.example.com internal.example.com
or
scp -oProxyJump=bastion.example.com internal.example.com