LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

CVE-2026-11746

creationtimestamp| type| source ---|---|--- 2026-09-11 21:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvbjqqanfy2g 2026-09-11 22:37:25+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg 2026-09-12...

EUVD-2026-38206

Central Dogma: SSH host-key verification permanently disabled in Git mirror SshGitMirror...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

com.linecorp.centraldogma:centraldogma-server-auth-saml (>=0.33.0, <=0.83.0), com.linecorp.centraldogma:centraldogma-server-auth-shiro (>=0.33.0, <=0.83.0) +8 more potentially affected by CVE-2026-11746 via com.linecorp.centraldogma:centraldogma-server (>=0.17.0, <=0.83.0)

com.linecorp.centraldogma:centraldogma-server MAVEN version =0.17.0, =0.33.0, =0.33.0, =0.61.0, =0.62.0, =0.17.0, =0.44.0, =0.44.0, =0.44.0, =0.64.0, =0.83.0 Source cves: CVE-2026-11746 Source advisory: OSV:GHSA-2J95-GQXF-V3VG...

com.linecorp.centraldogma:centraldogma-server-auth-saml (>=0.33.0, <=0.83.0), com.linecorp.centraldogma:centraldogma-server-auth-shiro (>=0.33.0, <=0.83.0) +8 more potentially affected by CVE-2026-11746 via com.linecorp.centraldogma:centraldogma-server (>=0.17.0, <=0.83.0)

com.linecorp.centraldogma:centraldogma-server MAVEN version =0.17.0, =0.33.0, =0.33.0, =0.61.0, =0.62.0, =0.17.0, =0.44.0, =0.44.0, =0.44.0, =0.64.0, =0.83.0 Source cves: CVE-2026-11746 Source advisory: GHSA-2J95-GQXF-V3VG...

EUVD-2026-38208

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-18958665...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: MEND:CVE-2026-11751...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: SNYK:JAVA-ORGAPACHESSHD-19352146...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: MEND:CVE-2026-56623...

com.linecorp.centraldogma:centraldogma-server-auth-saml (>=0.33.0, <=0.83.0), com.linecorp.centraldogma:centraldogma-server-auth-shiro (>=0.33.0, <=0.83.0) +8 more potentially affected by CVE-2026-11746 via com.linecorp.centraldogma:centraldogma-server (>=0.17.0, <=0.83.0)

com.linecorp.centraldogma:centraldogma-server MAVEN version =0.17.0, =0.33.0, =0.33.0, =0.61.0, =0.62.0, =0.17.0, =0.44.0, =0.44.0, =0.44.0, =0.64.0, =0.83.0 Source cves: CVE-2026-11746 Source advisory: SNYK:JAVA-COMLINECORPCENTRALDOGMA-17393812...

Use of Hard-coded Credentials

Overview com.linecorp.centraldogma:centraldogma-server is a service configuration repository based on Git, ZooKeeper and HTTP/2 centraldogma-server. Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the ZooKeeperReplicationConfig.secret when the replication.secr...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the SSH client not verifying remote host keys for git+ssh:// connections. An attacker can intercept and compromise mirrored repositories by performing man-in-the-middle attacks...

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11745

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...