CVE-2026-11746: centraldogma-server Auth Bypass Flaw

CVE-2026-11746 Overview

CVE-2026-11746 affects centraldogma-server versions prior to 0.84.0. The server falls back to a hard-coded, publicly known secret when ZooKeeper replication is enabled without configuring replication.secret. This default credential authenticates the embedded ZooKeeper ensemble. An attacker with adjacent network access can read the full replication log or join the quorum. Quorum membership lets the attacker execute arbitrary replicated commands across the cluster. The flaw is categorized under CWE-798: Use of Hard-coded Credentials.

Critical Impact
Unauthenticated adjacent-network attackers can read replicated data and execute arbitrary commands across all Central Dogma cluster nodes.

Affected Products

LINE centraldogma-server versions prior to 0.84.0
Deployments using embedded ZooKeeper replication
Clusters where replication.secret is not explicitly configured

Discovery Timeline

2026-06-22 - CVE-2026-11746 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11746

Vulnerability Analysis

Central Dogma is a highly-available service configuration repository developed by LINE. The server supports clustering through an embedded Apache ZooKeeper ensemble. Replication traffic between nodes is authenticated using a shared secret defined by replication.secret. When operators enable replication but omit this configuration value, the server silently selects a hard-coded default rather than failing closed. The default value is present in the public source repository and is therefore known to any attacker who inspects the project.

An attacker on an adjacent network can authenticate to the ZooKeeper ensemble using this known secret. Once authenticated, the attacker can read the entire replication log, exposing every repository, commit, and configuration value managed by Central Dogma. The attacker can also join the quorum and issue replicated write operations, propagating arbitrary changes to all cluster members.

Root Cause

The server lacks a fail-safe check on the replication.secret configuration. Instead of refusing to start or generating a unique secret, it defaults to a static value bundled with the codebase. This is a textbook hard-coded credential weakness under [CWE-798].

Attack Vector

Exploitation requires network reachability to the ZooKeeper replication ports exposed by Central Dogma nodes. No prior authentication, user interaction, or elevated privileges are needed. The attacker presents the publicly known secret during the ZooKeeper authentication handshake and gains full quorum participation rights. Refer to the GitHub Security Advisory GHSA-2j95-gqxf-v3vg for upstream technical details.

Detection Methods for CVE-2026-11746

Indicators of Compromise

Unexpected ZooKeeper client connections originating from hosts outside the documented cluster membership.
Unauthorized commits, repository creations, or configuration changes appearing simultaneously on multiple cluster nodes.
Central Dogma startup logs that show replication enabled without an operator-supplied replication.secret value.

Detection Strategies

Audit running centraldogma-server processes and configuration files for the presence of an explicit replication.secret entry.
Compare deployed Central Dogma binaries against versions 0.84.0 and later using package inventory or software bill of materials tooling.
Review ZooKeeper authentication logs for sessions established from non-cluster IP addresses.

Monitoring Recommendations

Alert on TCP connections to ZooKeeper client and quorum ports from sources outside an allow-listed cluster subnet.
Forward Central Dogma and ZooKeeper logs to a central log platform and create rules for anomalous quorum membership changes.
Track repository write rates and trigger alerts on bulk modifications inconsistent with normal operator activity.

How to Mitigate CVE-2026-11746

Immediate Actions Required

Upgrade centraldogma-server to version 0.84.0 or later on every cluster node.
Set a unique, high-entropy value for replication.secret in each deployment configuration before restarting the cluster.
Restrict ZooKeeper ports to the cluster subnet using host firewalls or network access control lists.
Rotate any secrets, tokens, or configuration values previously stored in Central Dogma repositories, since the replication log may have been exposed.

Patch Information

The maintainers fixed CVE-2026-11746 in centraldogma-server0.84.0. The patched release stops the server from falling back to a hard-coded secret and requires operators to provide replication.secret explicitly when replication is enabled. Patch details are documented in the GitHub Security Advisory GHSA-2j95-gqxf-v3vg.

Workarounds

Disable ZooKeeper replication on affected nodes until the upgrade is applied.
Place Central Dogma cluster nodes behind a dedicated management VLAN with strict ingress filtering.
Enforce mutual TLS or IPsec between cluster members to limit exposure of the ZooKeeper protocol to unauthorized peers.

bash

# Configuration example
# dogma.json - set a unique replication secret
{
  "replication": {
    "method": "ZOOKEEPER",
    "secret": "REPLACE_WITH_HIGH_ENTROPY_VALUE",
    "serverId": 1,
    "servers": [
      { "host": "node1.internal", "quorumPort": 2888, "electionPort": 3888 },
      { "host": "node2.internal", "quorumPort": 2888, "electionPort": 3888 },
      { "host": "node3.internal", "quorumPort": 2888, "electionPort": 3888 }
    ]
  }
}