DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-11745: CVE-2026-11745: Host Key Verification Bypass in Central Dogma Git Mirror SSH Client

#security #cve #cybersecurity

CVE-2026-11745: Host Key Verification Bypass in Central Dogma Git Mirror SSH Client

Vulnerability ID: CVE-2026-11745
CVSS Score: 8.8
Published: 2026-09-11

An issue was identified in Central Dogma prior to version 0.84.0. The Git mirror SSH client does not verify remote host keys for git+ssh:// connections, which allows an on-path attacker to execute man-in-the-middle attacks and compromise mirrored repositories.

TL;DR

Central Dogma versions prior to 0.84.0 fail to verify SSH host keys during Git mirror processes. This vulnerability enables adjacent or on-path attackers to perform Man-in-the-Middle attacks, allowing them to exfiltrate configurations or introduce malicious commits.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-322
  • Attack Vector: Adjacent Network
  • CVSS v4.0 Score: 8.8
  • EPSS Score: 0.00219
  • EPSS Percentile: 12.34%
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • Central Dogma Server
  • centraldogma-server-mirror-git
  • centraldogma-server-mirror-git: < 0.84.0 (Fixed in: 0.84.0)

Code Analysis

Commit: c5371ab

Fix host key verification logic in SshGitMirror

Commit: 09b5db8

Release v0.84.0

Commit: b96f6a9

Support loading trusted host keys with fallback behavior

Mitigation Strategies

  • Upgrade Central Dogma server dependencies to version 0.84.0 or above.
  • Explicitly configure remote Git host public key fingerprints inside the trustedHostKeys mapping of the dogma.json configuration.
  • Restrict outbound SSH connectivity from Central Dogma instances to known, static IP blocks matching your Git hosting provider.
  • Monitor application standard output for warnings regarding missing trustedHostKeys configurations.

Remediation Steps:

  1. Retrieve the cryptographic fingerprints of your remote Git hosting endpoints using the ssh-keyscan tool.
  2. Open your deployment configuration file (dogma.json) and locate the MirroringServicePluginConfig entry.
  3. Insert the retrieved fingerprints under the trustedHostKeys property mapped to the appropriate hostname.
  4. Update your service configuration script, Dockerfile, or Maven POM to require centraldogma-server-mirror-git version 0.84.0 or greater.
  5. Redeploy the Central Dogma service instance and inspect the startup logs to ensure no unverified key warning messages are emitted.

References

Read the full report for CVE-2026-11745 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)