{"vulnerability": "ghsa-vjfw-cpmh-xwv3", "sightings": [{"uuid": "417328a6-cba7-4ee0-9a93-d5f3e591415f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vjfw-cpmh-xwv3", "type": "seen", "source": "https://gist.github.com/alon710/411b8b7ebc2e2afc168687232502ef72", "content": "# CVE-2026-11745: CVE-2026-11745: Host Key Verification Bypass in Central Dogma Git Mirror SSH Client\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-11745\n\n## Summary\nAn issue was identified in Central Dogma prior to version 0.84.0. The Git mirror SSH client does not verify remote host keys for git+ssh:// connections, which allows an on-path attacker to execute man-in-the-middle attacks and compromise mirrored repositories.\n\n## TL;DR\nCentral Dogma versions prior to 0.84.0 fail to verify SSH host keys during Git mirror processes. This vulnerability enables adjacent or on-path attackers to perform Man-in-the-Middle attacks, allowing them to exfiltrate configurations or introduce malicious commits.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-322\n- **Attack Vector**: Adjacent Network\n- **CVSS v4.0 Score**: 8.8\n- **EPSS Score**: 0.00219\n- **EPSS Percentile**: 12.34%\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Central Dogma Server\n- centraldogma-server-mirror-git\n- **centraldogma-server-mirror-git**: < 0.84.0 (Fixed in: `0.84.0`)\n\n## Mitigation\n\n- Upgrade Central Dogma server dependencies to version 0.84.0 or above.\n- Explicitly configure remote Git host public key fingerprints inside the trustedHostKeys mapping of the dogma.json configuration.\n- Restrict outbound SSH connectivity from Central Dogma instances to known, static IP blocks matching your Git hosting provider.\n- Monitor application standard output for warnings regarding missing trustedHostKeys configurations.\n\n**Remediation Steps:**\n1. Retrieve the cryptographic fingerprints of your remote Git hosting endpoints using the ssh-keyscan tool.\n2. Open your deployment configuration file (dogma.json) and locate the MirroringServicePluginConfig entry.\n3. Insert the retrieved fingerprints under the trustedHostKeys property mapped to the appropriate hostname.\n4. Update your service configuration script, Dockerfile, or Maven POM to require centraldogma-server-mirror-git version 0.84.0 or greater.\n5. Redeploy the Central Dogma service instance and inspect the startup logs to ensure no unverified key warning messages are emitted.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjfw-cpmh-xwv3](https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3)\n- [NVD - CVE-2026-11745](https://nvd.nist.gov/vuln/detail/CVE-2026-11745)\n- [Central Dogma Setup & Mirroring Documentation](https://line.github.io/centraldogma/setup-configuration.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-11745) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T21:32:59.362510Z"}]}