EUVD-2026-38207
GHSA-2j95-gqxf-v3vg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable Central Dogma cluster
-
DeliveryConnect to ZooKeeper replication port
-
ExploitAuthenticate with hard-coded secret
-
ExecutionJoin quorum or tail replication log
-
PersistSubmit replicated commands cluster-wide
-
ImpactPivot via exfiltrated config secrets
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target centraldogma-server to be running a version prior to 0.84.0 with ZooKeeper replication enabled, (2) the operator to have failed to set the replication.secret configuration property - which triggers the silent fallback to the hard-coded value, and (3) the attacker to have adjacent-network reachability (CVSS AV:A) to the embedded ZooKeeper ensemble ports on a cluster node. Single-node deployments without replication, and clusters where replication.secret was explicitly configured, are not exposed. No authentication, user interaction, or special platform is required once the network and configuration prerequisites are met (PR:N, UI:N, AT:N). |
| Impact | The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H produces a 9.4 score, reflecting an adjacent-network, unauthenticated path to full compromise of every node in the cluster - a realistic rating given the hard-coded secret. EPSS, KEV status, and POC availability are not provided in the source data, so exploitation probability cannot be quantified; however, hard-coded secrets historically attract rapid public exploitation once disclosed. The AV:A (adjacent) constraint and the requirement that an operator actually enabled replication without setting replication.secret do meaningfully limit the exposed population compared with a default-on internet-facing flaw. Treat as high-priority for any deployment running replicated Central Dogma, but lower priority for single-node or properly-configured clusters; verify your replication.secret setting before patch scheduling. |
| Exploit ScenarioDerived | An attacker who gains a foothold on the same network segment as a Central Dogma cluster (for example, a compromised CI runner or neighboring container) scans for the ZooKeeper replication ports and connects using the publicly known hard-coded secret. Once authenticated to the ensemble they either passively stream the replication log to harvest configuration secrets stored in Central Dogma, or actively join the quorum and submit replicated commands that propagate malicious configuration to every consuming application. No public exploit identified at time of analysis, but reproducing this requires only reading the open-source repository to recover the hard-coded value. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Cluster-wide remote code execution in LY Corporation's centraldogma-server prior to 0.84.0 occurs when ZooKeeper replication is enabled without explicitly configuring replication.secret, causing the embedded ZooKeeper ensemble to authenticate using a hard-coded, publicly known fallback credential. An adjacent attacker with network reachability to the replication ports can read the entire replication log or join the quorum to issue arbitrary replicated commands. No public exploit identified at time of analysis, but the issue is a default-credential failure that is trivial to weaponize once discovered.
RemediationAI
Vendor-released patch: Central Dogma 0.84.0 - upgrade centraldogma-server to 0.84.0 or later, which removes the silent fallback to the hard-coded secret. As an immediate workaround on unpatched nodes, explicitly set a strong, randomly generated replication.secret in the server configuration on every cluster member so the hard-coded default is never used; restart nodes in a rolling fashion to avoid quorum loss. If patching is delayed, restrict network reachability of the ZooKeeper replication ports to only the cluster's own nodes (host firewall or security group rules) - this prevents external quorum-joining but does not protect against adjacent attackers already on the management network. Review historical replication logs for unexpected writes or membership changes, and rotate any secrets or configuration data stored in Central Dogma that may have been exposed. Refer to the vendor advisory at https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg for canonical guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Central Dogma is LY Corporation's highly-available, Git-backed configuration repository service that uses an embedded Apache ZooKeeper ensemble to coordinate replication across nodes (CPE cpe:2.3:a:ly_corporation:central_dogma). ZooKeeper quorum members authenticate to each other using a shared secret; in vulnerable releases the server fails open when the operator does not set the replication.secret configuration key, silently substituting a hard-coded value baked into the codebase. Although no CWE is assigned in the input, this matches CWE-798 (Use of Hard-coded Credentials) combined with CWE-1188 (insecure default initialization). Because the ZooKeeper ensemble is the source of truth for replicated commands, anyone who can speak the quorum protocol with the right secret becomes a peer of the cluster.
Know when Central Dogma gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Adjacent ZooKeeper port reachability (AV:A), no auth thanks to hard-coded secret (PR:N), low complexity, and scope change because cluster-wide replicated commands affect all peers.
Primary rating from Vendor (LY-Corporation).
CVSS VectorVendor: LY-Corporation
DescriptionCVE.org
A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.
Executive ViewAI
LY Corporation's centraldogma-server is vulnerable to cluster-wide remote code execution when ZooKeeper replication is enabled without explicit credential configuration. Attackers with network access to replication ports can execute arbitrary commands using hard-coded default credentials, exposing the entire system to immediate compromise. Organizations running this component with default replication settings face critical risk of infrastructure takeover and data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Explicitly configure a non-default replication.secret value in all deployment configurations immediately to override hard-coded fallback credential; (2) Restrict network access to ZooKeeper replication ports via firewall to trusted internal networks only; (3) Disable ZooKeeper replication if operationally feasible; (4) Implement continuous monitoring and alerting for unauthorized access attempts to replication ports.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Central Dogma
View allMan-in-the-middle attacks against LY Corporation's Central Dogma server can compromise mirrored Git repositories in vers
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the a
Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to u
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of
Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web scr
Exploit-DB