LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

EUVD-2026-38208

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: SNYK:JAVA-ORGAPACHESSHD-19352146...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: MEND:CVE-2026-56623...

com.linecorp.centraldogma:centraldogma-server-auth-saml (>=0.33.0, <=0.83.0), com.linecorp.centraldogma:centraldogma-server-auth-shiro (>=0.33.0, <=0.83.0) +8 more potentially affected by CVE-2026-11746 via com.linecorp.centraldogma:centraldogma-server (>=0.17.0, <=0.83.0)

com.linecorp.centraldogma:centraldogma-server MAVEN version =0.17.0, =0.33.0, =0.33.0, =0.61.0, =0.62.0, =0.17.0, =0.44.0, =0.44.0, =0.44.0, =0.64.0, =0.83.0 Source cves: CVE-2026-11746 Source advisory: SNYK:JAVA-COMLINECORPCENTRALDOGMA-17393812...

Use of Hard-coded Credentials

Overview com.linecorp.centraldogma:centraldogma-server is a service configuration repository based on Git, ZooKeeper and HTTP/2 centraldogma-server. Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the ZooKeeperReplicationConfig.secret when the replication.secr...

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11748

The CVE affects centraldogma-server-auth-shiro

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...

CVE-2026-11746

CVE-2026-11746 affects centraldogma-server versions prior to 0.84.0. If ZooKeeper replication is enabled without setting replication.secret, the server falls back to a hard-coded, publicly known secret that authenticates the embedded ZooKeeper ensemble. This allows an attacker with network access...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11745: Undefined Security Weakness

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

CVE-2026-11746: Undefined Security Weakness

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11748: Undefined Security Weakness

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...

PT-2026-51270

Name of the Vulnerable Software and Affected Versions centraldogma-server-mirror-git versions prior to 0.84.0 Description The Git mirror SSH client fails to verify remote host keys for git+ssh:// connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-48827 via org.apache.sshd:sshd-git (>=2.2.0, <=2.17.1)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-48827 Source advisory: OSV:GHSA-MW4M-QHPG-J82M...