CVE-2026-11748

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:28+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75 2026-09-12 04:32:07+00:00| seen| https://gist.github.com/alon710/c05d2b733514467507b538dab5375550...

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

GHSA-VJFW-CPMH-XWV3 Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

GHSA-2J95-GQXF-V3VG Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

GHSA-98Q5-5QH2-7W75 Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2025-11222

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

GHSA-4HR2-XF7W-JF76 Central Dogma's Login Function Has an Open Redirect Vulnerability

Impact Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and...

Central Dogma's Login Function Has an Open Redirect Vulnerability

Impact Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and...

CVE-2025-11222

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

CVE-2025-11222

Central Dogma is affected by an Open Redirect vulnerability in the login flow for versions before 0.78.0. A crafted URL can redirect users to untrusted sites, enabling phishing and potential credential theft. The issue is documented across multiple sources (NVD/Red Hat OSV/GHSA etc.) with the fix...

CVE-2025-11222

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

CVE-2025-11222

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

CVE-2025-11222

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

EUVD-2025-201153

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

Central Dogma 安全漏洞

Central Dogma is an open source service configuration version control repository based on Git, ZooKeeper and HTTP/2. A security vulnerability exists in Central Dogma versions prior to 0.78.0, which stems from an open redirect and could lead to phishing attacks and credential theft...

PT-2025-49019

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...

CVE-2025-11222: URL Redirection to Untrusted Site

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...