EUVD-2026-38206Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MITM over network-reachable SSH justifies AV:N with AC:H for the on-path requirement; no auth or UI; scope changes as poisoned mirrors affect downstream consumers, with high C/I and no availability impact.
Primary rating from Vendor (LY-Corporation).
CVSS VectorVendor: LY-Corporation
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
AnalysisAI
Man-in-the-middle attacks against LY Corporation's Central Dogma server can compromise mirrored Git repositories in versions of the centraldogma-server-mirror-git module prior to 0.84.0, because the embedded SSH client accepts any host key presented over git+ssh:// connections. An on-path attacker between Central Dogma and the upstream Git server can impersonate that server, inject malicious commits, and silently poison every downstream consumer that reads from the mirror. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Central Dogma is LY Corporation's highly-available service-configuration repository, frequently used as a source of truth for application config and feature flags; its Git mirror subsystem (centraldogma-server-mirror-git) pulls from external Git repositories so that operators can manage configuration with normal Git workflows. The defect is a classic missing-host-key-verification flaw in its SSH transport (root cause class CWE-322 'Key Exchange without Entity Authentication', closely related to CWE-295 'Improper Certificate Validation'): the SSH client used for git+ssh:// transports does not check the remote server's public key against a trust store such as known_hosts, so it cannot distinguish the legitimate Git server from any TCP peer that completes the handshake. Affected CPE: cpe:2.3:a:ly_corporation:central_dogma:*:*:*:*:*:*:*:* (all versions prior to 0.84.0).
RemediationAI
Vendor-released patch: Central Dogma 0.84.0 - upgrade the centraldogma-server-mirror-git component to 0.84.0 or later per advisory GHSA-vjfw-cpmh-xwv3 (https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3). Until the upgrade is rolled out, the most effective compensating controls are to switch existing mirror definitions from git+ssh:// to git+https:// with TLS-validated endpoints (side effect: requires the upstream Git server to expose HTTPS and may require reissuing credentials), or to constrain outbound SSH from the Central Dogma host so it can only reach the legitimate upstream Git server's IP, eliminating the on-path opportunity (side effect: breaks if upstream IPs change, and does not protect against attackers who can spoof that route). Auditing recent commits pulled via git+ssh:// mirrors after the patch is applied is recommended to detect any prior tampering.
More in Central Dogma
View allCluster-wide remote code execution in LY Corporation's centraldogma-server prior to 0.84.0 occurs when ZooKeeper replica
Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the a
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to u
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of
Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web scr
Same weakness CWE-322 – Key Exchange without Entity Authentication
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today