CVE-2026-11745: Central Dogma Git Mirror MitM Vulnerability

CVE-2026-11745 Overview

CVE-2026-11745 affects centraldogma-server-mirror-git versions prior to 0.84.0. The Git mirror SSH client fails to verify remote host keys when establishing git+ssh:// connections. An on-path attacker can intercept these connections, impersonate the legitimate Git server, and inject malicious content into mirrored repositories. The flaw is categorized under CWE-322: Key Exchange without Entity Authentication. Successful exploitation compromises the integrity and confidentiality of mirrored repositories used by Central Dogma deployments.

Critical Impact
An adjacent network attacker can hijack Git mirror SSH traffic, substitute arbitrary repository content, and propagate malicious code into systems consuming the mirrored configuration data.

Affected Products

centraldogma-server-mirror-git versions prior to 0.84.0
Central Dogma deployments configured with git+ssh:// mirror sources
Downstream services consuming repositories mirrored by affected Central Dogma instances

Discovery Timeline

2026-06-22 - CVE-2026-11745 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11745

Vulnerability Analysis

The vulnerability resides in the Git mirror SSH client logic of centraldogma-server-mirror-git. When Central Dogma initiates a git+ssh:// mirror operation, the SSH client establishes a connection to the remote Git server without validating the presented host key. Standard SSH security relies on the client comparing the server's host key against a known-good fingerprint stored in known_hosts or an equivalent trust store. By skipping this check, the client accepts any host key offered by the peer, including one controlled by an attacker.

This defect breaks the entity authentication property of the SSH protocol. The attacker does not need credentials to the legitimate Git server. They only need to sit between Central Dogma and the upstream server, terminate the SSH handshake, and present synthetic repository data over the resulting trusted channel.

Root Cause

The root cause is missing host key verification in the Git mirror SSH client configuration, as classified by CWE-322. The client neither enforces strict host key checking nor pins the expected fingerprint. As a result, the cryptographic key exchange completes without authenticating the remote endpoint, leaving the channel vulnerable to active interception.

Attack Vector

Exploitation requires the attacker to be positioned on the network path between Central Dogma and the upstream Git server. Techniques include ARP spoofing on a shared segment, rogue DHCP, BGP hijacking, or compromise of an intermediate router. Once positioned, the attacker terminates the inbound SSH handshake using an attacker-controlled host key, then proxies or fabricates Git protocol responses. The mirrored repository is overwritten with attacker-supplied commits, which then flow into any service that consumes Central Dogma configuration data.

The vulnerability manifests in the SSH client connection setup path of the Git mirror module. See the GitHub Security Advisory GHSA-vjfw-cpmh-xwv3 for the authoritative technical description and patch reference.

Detection Methods for CVE-2026-11745

Indicators of Compromise

Unexpected commits or branch updates in mirrored repositories that do not correspond to activity on the upstream Git server.
SSH connections from Central Dogma to Git mirror hosts terminating at unexpected IP addresses or presenting unknown host key fingerprints.
Divergence between the commit history stored by Central Dogma and the commit history on the authoritative upstream Git server.

Detection Strategies

Compare the host key fingerprints observed in Central Dogma SSH sessions against the authoritative fingerprints published by the upstream Git provider.
Monitor mirrored repository contents and alert on commits introduced without a corresponding upstream push event or webhook.
Inspect network flows from Central Dogma servers for SSH connections that terminate at hosts other than the documented Git endpoints.

Monitoring Recommendations

Enable verbose logging on the Central Dogma mirror subsystem and forward logs to a centralized analytics platform for review.
Implement integrity checks that cryptographically verify commit signatures on mirrored content where upstream signing is available.
Audit ARP and DHCP tables on segments hosting Central Dogma to detect spoofing precursors to on-path interception.

How to Mitigate CVE-2026-11745

Immediate Actions Required

Upgrade centraldogma-server-mirror-git to version 0.84.0 or later on all Central Dogma instances.
Inventory all existing git+ssh:// mirror configurations and rotate any credentials that may have been exposed through hijacked sessions.
Re-mirror affected repositories from a trusted network path and compare commit hashes against the authoritative upstream history.

Patch Information

The vendor fix is delivered in centraldogma-server-mirror-git version 0.84.0, which enforces SSH host key verification for git+ssh:// mirror connections. Refer to the GitHub Security Advisory GHSA-vjfw-cpmh-xwv3 for upgrade guidance and release notes.

Workarounds

Switch affected mirror configurations from git+ssh:// to https:// with TLS certificate validation until the upgrade is applied.
Restrict Central Dogma egress traffic to known Git server IP ranges using firewall or service mesh policies to reduce on-path attack opportunities.
Run Central Dogma mirror traffic over dedicated VPN tunnels or private network links that prevent untrusted parties from reaching the SSH session.

bash

# Configuration example: pin a verified host key for the upstream Git server
ssh-keyscan -t rsa,ecdsa,ed25519 git.example.com >> ~/.ssh/known_hosts
ssh-keygen -lf ~/.ssh/known_hosts  # verify fingerprints against vendor-published values

# Enforce strict host key checking for the Central Dogma service account
cat <<EOF >> ~/.ssh/config
Host git.example.com
    StrictHostKeyChecking yes
    UserKnownHostsFile ~/.ssh/known_hosts
EOF