Executive brief
Central Dogma is a configuration store that mirrors remote Git repositories over SSH to distribute credentials, API keys, certificates, and feature flags to microservices. An attacker on the corporate network (via ARP spoofing, DNS poisoning, BGP hijack, or Kubernetes compromise) can intercept Git mirror connections and either exfiltrate all mirrored secrets or inject malicious configuration that propagates to all downstream services, because the SSH client unconditionally accepts any host key without verification.
Technical details
The vulnerability is a missing host-key verification (CWE-322: Key Exchange without Entity Authentication) in the SshGitMirror.java SSH client. The vulnerable code at line 149 installs a lambda `serverKeyVerifier((clientSession, remoteAddress, serverKey) -> true)` that unconditionally accepts any presented host key, and lines 146–147 explicitly disable known_hosts and ~/.ssh/config fallbacks. No operator-facing host-key pinning mechanism exists anywhere in server-mirror-git/. An on-path attacker (adjacent network, DNS poisoning, BGP hijack, or sidecar compromise) can impersonate the remote Git server during mirror synchronization. This enables two attack directions: (1) exfiltration of the entire mirrored repository (which contains secrets like DB credentials and API keys), and (2) injection of arbitrary commits that Central Dogma broadcasts to every subscribing microservice, creating a supply-chain compromise. The credential theft chain is extended because mirror credentials are not bound to a hostname, allowing captured SSH keys to be replayed against the real upstream. Patch 0.84.0 adds host-key pinning support.
Affected products
- Line Central Dogma < 0.84.0
Timeline
- 2026-06-22: disclosed: Vulnerability publicly disclosed
- 2026-06-22: patched: Patch released in version 0.84.0
- 2026-09-11: advisory: GitHub Advisory Database entry published