Which versions of Central Dogma are affected by CVE-2026-11746?

LY Corporation's centraldogma-server is vulnerable to cluster-wide remote code execution when ZooKeeper replication is enabled without explicit credential configuration.

How to fix or mitigate CVE-2026-11746?

Within 24 hours: Identify all centraldogma-server deployments with ZooKeeper replication enabled; implement network firewall rules restricting access to replication ports (2181, 2888, 3888) to authorized internal hosts only. Within 7 days: Explicitly configure a strong replication.secret value in all affected instances and restart services to enforce new credentials. Within 30 days: Monitor vendor advisories for centraldogma-server version 0.84.0 or later release; evaluate operational alternatives if patch delivery extends beyond 30 days.

Central Dogma CVE-2026-11746

Q: What is the CVSS score of CVE-2026-11746?

CVE-2026-11746 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38207 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-06-22 LY-Corporation

Authentication Bypass Central Dogma Ly Corporation

9.4

CVSS 4.0 · Vendor: LY-Corporation

Severity by source

Vendor (LY-Corporation) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Adjacent ZooKeeper port reachability (AV:A), no auth thanks to hard-coded secret (PR:N), low complexity, and scope change because cluster-wide replicated commands affect all peers.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (LY-Corporation).

CVSS VectorVendor: LY-Corporation

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:12 vuln.today

DescriptionCVE.org

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

AnalysisAI

Cluster-wide remote code execution in LY Corporation's centraldogma-server prior to 0.84.0 occurs when ZooKeeper replication is enabled without explicitly configuring replication.secret, causing the embedded ZooKeeper ensemble to authenticate using a hard-coded, publicly known fallback credential. An adjacent attacker with network reachability to the replication ports can read the entire replication log or join the quorum to issue arbitrary replicated commands. No public exploit identified at time of analysis, but the issue is a default-credential failure that is trivial to weaponize once discovered.

Technical ContextAI

Central Dogma is LY Corporation's highly-available, Git-backed configuration repository service that uses an embedded Apache ZooKeeper ensemble to coordinate replication across nodes (CPE cpe:2.3:a:ly_corporation:central_dogma). ZooKeeper quorum members authenticate to each other using a shared secret; in vulnerable releases the server fails open when the operator does not set the replication.secret configuration key, silently substituting a hard-coded value baked into the codebase. Although no CWE is assigned in the input, this matches CWE-798 (Use of Hard-coded Credentials) combined with CWE-1188 (insecure default initialization). Because the ZooKeeper ensemble is the source of truth for replicated commands, anyone who can speak the quorum protocol with the right secret becomes a peer of the cluster.

RemediationAI

Vendor-released patch: Central Dogma 0.84.0 - upgrade centraldogma-server to 0.84.0 or later, which removes the silent fallback to the hard-coded secret. As an immediate workaround on unpatched nodes, explicitly set a strong, randomly generated replication.secret in the server configuration on every cluster member so the hard-coded default is never used; restart nodes in a rolling fashion to avoid quorum loss. If patching is delayed, restrict network reachability of the ZooKeeper replication ports to only the cluster's own nodes (host firewall or security group rules) - this prevents external quorum-joining but does not protect against adjacent attackers already on the management network. Review historical replication logs for unexpected writes or membership changes, and rotate any secrets or configuration data stored in Central Dogma that may have been exposed. Refer to the vendor advisory at https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg for canonical guidance.