CVE-2026-11745: LY Corporation Central Dogma SSH host key verification bypass in Git mirror

CVE-2026-11745 · Severity: high · CVSS 4 · Published 2026-06-22

Central Dogma is a configuration store that mirrors remote Git repositories over SSH to distribute credentials, API keys, certificates, and feature flags to microservices. An attacker on the corporate network (via ARP spoofing, DNS poisoning, BGP hijack, or Kubernetes compromise) can intercept Git mirror connections and either exfiltrate all mirrored secrets or inject malicious configuration that propagates to all downstream services, because the SSH client unconditionally accepts any host key without verification.

Technologies: LY Corporation Central Dogma. Vendors: LY Corporation, Maven.

Quick answers

Is CVE-2026-11745 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11745 being exploited in the wild.
How severe is CVE-2026-11745?
High severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
LY Corporation Central Dogma < 0.84.0; com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) < 0.84.0, ECOSYSTEM:introduced=0,fixed=0.84.0.
Is there a fix for CVE-2026-11745?
Yes. com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven): upgrade to 0.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11745 attacked?
It is attacked from the adjacent network or over the network, in a hosted service.
Am I affected by CVE-2026-11745?
Check whether you run LY Corporation Central Dogma or com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven): upgrade to 0.84.0 or later
    # set com.linecorp.centraldogma:centraldogma-server-mirror-git to 0.84.0 in your pom.xml or build.gradle

Technical details

The vulnerability is a missing host-key verification (CWE-322: Key Exchange without Entity Authentication) in the SshGitMirror.java SSH client. The vulnerable code at line 149 installs a lambda `serverKeyVerifier((clientSession, remoteAddress, serverKey) -> true)` that unconditionally accepts any presented host key, and lines 146–147 explicitly disable known_hosts and ~/.ssh/config fallbacks. No operator-facing host-key pinning mechanism exists anywhere in server-mirror-git/. An on-path attacker (adjacent network, DNS poisoning, BGP hijack, or sidecar compromise) can impersonate the remote Git server during mirror synchronization. This enables two attack directions: (1) exfiltration of the entire mirrored repository (which contains secrets like DB credentials and API keys), and (2) injection of arbitrary commits that Central Dogma broadcasts to every subscribing microservice, creating a supply-chain compromise. The credential theft chain is extended because mirror credentials are not bound to a hostname, allowing captured SSH keys to be replayed against the real upstream. Patch 0.84.0 adds host-key pinning support.

Affected products

  • Line Central Dogma < 0.84.0

Identifiers

  • CVE-2026-11745
  • GHSA-vjfw-cpmh-xwv3

Timeline

  • 2026-06-22: disclosed: Vulnerability publicly disclosed
  • 2026-06-22: patched: Patch released in version 0.84.0
  • 2026-09-11: advisory: GitHub Advisory Database entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.