DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-11746: CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server

#security #cve #cybersecurity

CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server

Vulnerability ID: CVE-2026-11746
CVSS Score: 9.4
Published: 2026-09-11

CVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.

TL;DR

Unauthenticated remote attackers with access to Central Dogma's replication ports can take over the cluster by authenticating with the default hard-coded replication secret 'ch4n63m3'.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-798
  • Attack Vector: Adjacent Network
  • CVSS v4.0 Score: 9.4 (Critical)
  • EPSS Score: 0.00229
  • Impact: Complete Cluster Takeover / Information Disclosure
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Central Dogma Server

Mitigation Strategies

  • Upgrade Central Dogma Server to version 0.84.0 or above to enforce secure cryptographic secrets on startup.
  • Explicitly configure a strong, random 'replication.secret' of at least 16 characters in dogma.json on all nodes.
  • Implement host-based firewalls or security groups to strictly isolate replication ports from unauthorized network segments.

Remediation Steps:

  1. Verify the current running version of Central Dogma Server and retrieve the dogma.json configuration.
  2. Generate a secure 32-character hex secret using 'openssl rand -hex 32'.
  3. Update dogma.json on every replica cluster node to include the generated secret within the 'replication' block.
  4. Upgrade the Central Dogma server installations to version 0.84.0 or later.
  5. Restart the services and verify the log output to confirm that the configuration is loaded securely.

References

Read the full report for CVE-2026-11746 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)