{"id":"CVE-2026-11745","aliases":["EUVD-2026-38206","GHSA-vjfw-cpmh-xwv3"],"status":"published","title":"Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)","description":"A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00219,"percentile":0.12492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-322"],"published":"2026-06-22T02:33:08Z","modified":"2026-11-10T02:46:02Z","fixes":[{"ecosystem":"Maven","package":"com.linecorp.centraldogma:centraldogma-server-mirror-git","fixed_in":["0.84.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.linecorp.centraldogma:centraldogma-server-mirror-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.84.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.linecorp.centraldogma:centraldogma-server-mirror-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.84.0"}]}],"versions":["0.62.0","0.62.1","0.63.0","0.63.1","0.63.2","0.63.3","0.64.0","0.64.1","0.64.2","0.64.3","0.65.0","0.65.1","0.66.0","0.66.1","0.67.0","0.67.1","0.67.2","0.67.3","0.68.0","0.69.0","0.69.1","0.70.0","0.71.0","0.72.0","0.73.0","0.73.1","0.74.0","0.75.0","0.75.1","0.76.0","0.77.0","0.77.1","0.77.2","0.77.3","0.77.4","0.78.0","0.78.1","0.79.0","0.79.1","0.79.2","0.80.0","0.81.0","0.82.0","0.83.0"]}],"products":[{"vendor":"line corporation","product":"central dogma"},{"vendor":"ly corporation","product":"central dogma"}],"references":[{"url":"https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3","tags":["exploit","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11745","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vjfw-cpmh-xwv3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11745.json","tags":["advisory"]},{"url":"https://github.com/line/centraldogma","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-11745","description":"A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.","status":"published","published":"2026-06-22T02:33:08.952Z","modified":"2026-06-22T16:29:43.057Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:20:04.809935Z"}],"euvd":[{"id":"EUVD-2026-38206","description":"A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.","status":"published","published":"2026-06-22T02:33:08Z","modified":"2026-06-22T16:29:43Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-vjfw-cpmh-xwv3","title":"Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)","description":"# Vulnerability\n\nCentral Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally for every outbound SSH connection used by `git+ssh://` mirrors. The accompanying lines disable the `known_hosts` and `~/.ssh/config` fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no `acceptedHostKeys`, `knownHosts`, `KnownHostsServerKeyVerifier`, `StaticServerKeyVerifier`, or `RequiredServerKeyVerifier`) exists anywhere in `server-mirror-git/`. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents.\n\n## Evidence\n\nFile: `server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java`\nLines 143-160 (especially 149) on branch `main` @ commit `d64a5151`:\n\n```java\nprivate SshClient createSshClient() {\n    final ClientBuilder builder = ClientBuilder.builder();\n    // Do not use local file system.\n    builder.hostConfigEntryResolver(HostConfigEntryResolver.EMPTY);   // line 146\n    builder.fileSystemFactory(NoneFileSystemFactory.INSTANCE);        // line 147\n    // Do not verify the server key.\n    builder.serverKeyVerifier((clientSession, remoteAddress, serverKey) -\u003e true);  // line 149\n    ...\n}\n```\n\nVerification:\n\n- Read confirmed on 2026-05-21 against `main` @ `d64a5151`.\n- A multi-agent code audit verified that no operator-facing pinning field exists on `SshKeyCredential`, `PasswordCredential`, or `MirrorContext`.\n- Exploit PoC reproduced locally with a `paramiko`-based fake SSH server bound to 127.0.0.1. The fake server presents an ephemeral RSA host key never seen before; the Central Dogma mirror client accepts the connection and proceeds to authentication, logging the offered username and public-key fingerprint. A correctly hardened SSH client would refuse the connection before reaching the authentication phase.\n- Full PoC artifacts (read-only, loopback-only) at `~/centraldogma-poc/C1_ssh_hostkey_bypass/` on the reporter's workstation.\n\n## Impact\n\nThreat model: An on-path attacker on the corporate network — ARP spoofing on the LAN, internal DNS poisoning, malicious internal DNS overriding `github.com` or the configured internal git hostname, BGP hijack, sidecar/CNI compromise in Kubernetes, or any process able to answer TCP on the resolved IP. No Central Dogma account required; only network position.\n\n1. **Direction `LOCAL_TO_REMOTE`**: the attacker impersonating the remote git server receives the entire mirrored repository contents over the SSH session. Central Dogma is a configuration store, so this typically exfiltrates DB credentials, third-party API keys, certificates, feature flags, and any other secret configuration committed to mirrored repositories.\n2. **Direction `REMOTE_TO_LOCAL`**: the attacker can serve arbitrary commits which Central Dogma materializes into the local repo and then broadcasts to every subscribing microservice via the watch API. This is a supply-chain root-of-trust compromise across all downstream services consuming Central Dogma configuration.\n3. **Credential theft chain with finding H2** (mirror credentials are not bound to a hostname): an SSH key or access token configured for `github.com` can be captured by the attacker's fake server and replayed against the real upstream, extending impact beyond Central Dogma itself.\n\nScope is `Changed` (CVSS) because exploitation alters trust assumptions of every downstream client of Central Dogma, not just Central Dogma itself.\n\n## How to fix\n\n1. Add an `acceptedHostKeys: List\u003cString\u003e` field to `SshKeyCredential` and `PasswordCredential` (or to `MirrorContext`). Values are SHA-256 fingerprints of trusted remote SSH server host keys, e.g. `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8`.\n2. Replace the accept-all lambda at `SshGitMirror.java:149` with a verifier that computes the SHA-256 fingerprint of the presented host key and compares it against the credential's allowlist using a constant-time comparison.\n3. Refuse to connect when `acceptedHostKeys` is empty — fail-closed. Do not implement implicit TOFU.\n4. Optionally provide an admin-only `dogma mirror probe-host-key \u003cremote\u003e` tool that performs a single audited connection, prints the server's fingerprint, and prompts the operator to add it to the credential. This makes TOFU an explicit, audited operation.\n5. Update `SshGitMirrorTest.java` and `it/mirror/*` tests to pin a test fingerprint or use the explicit trust-once tool, so the regression cannot silently return.","status":"published","published":"2026-09-11T20:45:50Z","modified":"2026-09-11T20:45:51Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2026-11745","description":"A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.","status":"published","published":"2026-06-22T03:16:42.67Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-11745","description":"A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.","status":"published","published":"2026-06-22T02:33:08.952Z","modified":"2026-11-10T02:46:02.544872216Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"updated_at":"2026-11-10T03:16:41.950556Z"},{"id":"GHSA-vjfw-cpmh-xwv3","title":"Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)","description":"# Vulnerability\n\nCentral Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally for every outbound SSH connection used by `git+ssh://` mirrors. The accompanying lines disable the `known_hosts` and `~/.ssh/config` fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no `acceptedHostKeys`, `knownHosts`, `KnownHostsServerKeyVerifier`, `StaticServerKeyVerifier`, or `RequiredServerKeyVerifier`) exists anywhere in `server-mirror-git/`. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents.\n\n## Evidence\n\nFile: `server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java`\nLines 143-160 (especially 149) on branch `main` @ commit `d64a5151`:\n\n```java\nprivate SshClient createSshClient() {\n    final ClientBuilder builder = ClientBuilder.builder();\n    // Do not use local file system.\n    builder.hostConfigEntryResolver(HostConfigEntryResolver.EMPTY);   // line 146\n    builder.fileSystemFactory(NoneFileSystemFactory.INSTANCE);        // line 147\n    // Do not verify the server key.\n    builder.serverKeyVerifier((clientSession, remoteAddress, serverKey) -\u003e true);  // line 149\n    ...\n}\n```\n\nVerification:\n\n- Read confirmed on 2026-05-21 against `main` @ `d64a5151`.\n- A multi-agent code audit verified that no operator-facing pinning field exists on `SshKeyCredential`, `PasswordCredential`, or `MirrorContext`.\n- Exploit PoC reproduced locally with a `paramiko`-based fake SSH server bound to 127.0.0.1. The fake server presents an ephemeral RSA host key never seen before; the Central Dogma mirror client accepts the connection and proceeds to authentication, logging the offered username and public-key fingerprint. A correctly hardened SSH client would refuse the connection before reaching the authentication phase.\n- Full PoC artifacts (read-only, loopback-only) at `~/centraldogma-poc/C1_ssh_hostkey_bypass/` on the reporter's workstation.\n\n## Impact\n\nThreat model: An on-path attacker on the corporate network — ARP spoofing on the LAN, internal DNS poisoning, malicious internal DNS overriding `github.com` or the configured internal git hostname, BGP hijack, sidecar/CNI compromise in Kubernetes, or any process able to answer TCP on the resolved IP. No Central Dogma account required; only network position.\n\n1. **Direction `LOCAL_TO_REMOTE`**: the attacker impersonating the remote git server receives the entire mirrored repository contents over the SSH session. Central Dogma is a configuration store, so this typically exfiltrates DB credentials, third-party API keys, certificates, feature flags, and any other secret configuration committed to mirrored repositories.\n2. **Direction `REMOTE_TO_LOCAL`**: the attacker can serve arbitrary commits which Central Dogma materializes into the local repo and then broadcasts to every subscribing microservice via the watch API. This is a supply-chain root-of-trust compromise across all downstream services consuming Central Dogma configuration.\n3. **Credential theft chain with finding H2** (mirror credentials are not bound to a hostname): an SSH key or access token configured for `github.com` can be captured by the attacker's fake server and replayed against the real upstream, extending impact beyond Central Dogma itself.\n\nScope is `Changed` (CVSS) because exploitation alters trust assumptions of every downstream client of Central Dogma, not just Central Dogma itself.\n\n## How to fix\n\n1. Add an `acceptedHostKeys: List\u003cString\u003e` field to `SshKeyCredential` and `PasswordCredential` (or to `MirrorContext`). Values are SHA-256 fingerprints of trusted remote SSH server host keys, e.g. `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8`.\n2. Replace the accept-all lambda at `SshGitMirror.java:149` with a verifier that computes the SHA-256 fingerprint of the presented host key and compares it against the credential's allowlist using a constant-time comparison.\n3. Refuse to connect when `acceptedHostKeys` is empty — fail-closed. Do not implement implicit TOFU.\n4. Optionally provide an admin-only `dogma mirror probe-host-key \u003cremote\u003e` tool that performs a single audited connection, prints the server's fingerprint, and prompts the operator to add it to the credential. This makes TOFU an explicit, audited operation.\n5. Update `SshGitMirrorTest.java` and `it/mirror/*` tests to pin a test fingerprint or use the explicit trust-once tool, so the regression cannot silently return.","status":"published","published":"2026-09-11T20:45:50Z","modified":"2026-09-11T21:00:06.354959044Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}