CVE-2026-11745
Description
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<0.84.0+ 1 more
- (no CPE)range: <0.84.0
- (no CPE)range: <0.84.0
Patches
Vulnerability mechanics
Root cause
"The Git mirror SSH client unconditionally trusts any host key presented by the remote server because the ServerKeyVerifier lambda always returns true."
Attack vector
An on-path attacker on the corporate network (e.g., ARP spoofing, DNS poisoning, BGP hijack, or sidecar compromise in Kubernetes) can impersonate the remote Git server for any `git+ssh://` mirror connection. Because the SSH client accepts every host key without verification [ref_id=1], the attacker can intercept the SSH session, exfiltrate mirrored repository contents (including secrets), or inject arbitrary commits that Central Dogma then propagates to all subscribing microservices. No Central Dogma account is required—only network position.
Affected code
The vulnerability resides in `server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java` (lines 143–160, especially line 149). The `createSshClient()` method installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally, and the surrounding lines disable `known_hosts` and `~/.ssh/config` fallbacks. No host-key pinning mechanism exists anywhere in the `server-mirror-git/` module.
What the fix does
The advisory recommends adding an `acceptedHostKeys` field to `SshKeyCredential` or `PasswordCredential`, replacing the accept-all lambda with a verifier that performs constant-time SHA-256 fingerprint comparison, and refusing to connect when the allowlist is empty (fail-closed). An optional admin tool for explicit trust-on-first-use is also suggested. No patch has been published yet; the advisory itself is the authoritative remediation guidance.
Preconditions
- networkAttacker must be on the network path between Central Dogma and the remote Git server (e.g., same LAN, compromised router, DNS poisoning).
- configThe mirror must use a git+ssh:// URL (SSH transport).
Generated on Jun 22, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.