EUVD-2026-38206

Central Dogma: SSH host-key verification permanently disabled in Git mirror SshGitMirror...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: SNYK:JAVA-ORGAPACHESSHD-19352146...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-56623 via org.apache.sshd:sshd-git (>=2.2.0, <=2.18.0)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-56623 Source advisory: MEND:CVE-2026-56623...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the SSH client not verifying remote host keys for git+ssh:// connections. An attacker can intercept and compromise mirrored repositories by performing man-in-the-middle attacks...

CVE-2026-11745: Undefined Security Weakness

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

PT-2026-51270

Name of the Vulnerable Software and Affected Versions centraldogma-server-mirror-git versions prior to 0.84.0 Description The Git mirror SSH client fails to verify remote host keys for git+ssh:// connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to...

com.infobip.kafkistry:kafkistry-app (>=0.7.0, <=0.10.2), com.infobip.kafkistry:kafkistry-auditing (>=0.7.0, <=0.10.2) +21 more potentially affected by CVE-2026-48827 via org.apache.sshd:sshd-git (>=2.2.0, <=2.17.1)

org.apache.sshd:sshd-git MAVEN version =2.2.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.9.9, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.62.0, =1.94.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-48827 Source advisory: OSV:GHSA-MW4M-QHPG-J82M...

com.linecorp.centraldogma:centraldogma-server-auth-saml (>=0.33.0, <=0.64.0), com.linecorp.centraldogma:centraldogma-server-auth-shiro (>=0.33.0, <=0.64.0) +7 more potentially affected by CVE-2024-1143 via com.linecorp.centraldogma:centraldogma-server (>=0.17.0, <=0.64.0)

com.linecorp.centraldogma:centraldogma-server MAVEN version =0.17.0, =0.33.0, =0.33.0, =0.61.0, =0.62.0, =0.17.0, =0.44.0, =0.44.0, =0.44.0, =0.64.0 - com.linecorp.centraldogma:centraldogma-xds 0.64.0 Source cves: CVE-2024-1143 Source advisory: MEND:CVE-2024-1143...