A vulnerability has been identified in centraldogma-server-mirror-git versions prior to…
Priority HIGH 73CWE-322Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed Central Dogma (LY Corporation): 0.84.0com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven): 0.84.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LY Corporation | Central Dogma | — | 0.84.0 | Patch available | CNA |
| — | com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) | before 0.84.0 | 0.84.0 | Patch available | GHSA-vjfw-cpmh-xwv3 |
- Central Dogma VendorLY Corporation Affected — Fixed in 0.84.0 Patch available CNA
- com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) Vendor— Affected before 0.84.0 Fixed in 0.84.0 Patch available GHSA-vjfw-cpmh-xwv3
Remediation
- Fix · CNA Central Dogma (LY Corporation) Fixed in 0.84.0
- Fix · GHSA-vjfw-cpmh-xwv3 com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) Fixed in 0.84.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-11745
- 2026-10-03 Alias added: GHSA-vjfw-cpmh-xwv3
References
More LY Corporation vulnerabilities
- TI-2026-10143 Hard-coded credentials in LY Corporation Central Dogma CVSS 4.0CRITICAL 9.4
- TI-2026-10145 LDAP injection in LY Corporation Central Dogma CVSS 4.0MEDIUM 6.9
- TI-2026-14054 A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. CVSS 4.0HIGH 8.7
- TI-2026-10146 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS… CVSS 4.0CRITICAL 9.1
- TI-2026-85778 Excessive memory allocation in Armeria from malformed Thrift messages CVSS 4.0HIGH 8.7
- TI-2026-85777 Path normalization flaw in Armeria lets attackers bypass access controls CVSS 4.0HIGH 8.7
Sources
- CVE-2026-11745 · CVE Program
- CVE-2026-11745 · NVD
- FIRST EPSS
- GHSA-vjfw-cpmh-xwv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences