Central Dogma CVE-2026-11748

Q: What is the CVSS score of CVE-2026-11748?

CVE-2026-11748 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38208 MEDIUM

LDAP Injection (CWE-90)

2026-06-22 LY-Corporation

Information Disclosure Central Dogma LDAP Code Injection

6.9

CVSS 4.0 · Vendor: LY-Corporation

Severity by source

Vendor (LY-Corporation) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable login endpoint, no credentials required; limited confidentiality and integrity impact from directory enumeration and auth confusion only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (LY-Corporation).

CVSS VectorVendor: LY-Corporation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:50 vuln.today

DescriptionCVE.org

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.

AnalysisAI

LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to authentication confusion and Active Directory enumeration. The SearchFirstActiveDirectoryRealm component in centraldogma-server-auth-shiro versions prior to 0.84.0 inserts the login username directly into an LDAP search filter without escaping metacharacters, allowing filter logic manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or preconditions are required beyond reaching the login endpoint. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Central Dogma is LY Corporation's highly available version-control service for configuration data. Its optional LDAP/Active Directory authentication path relies on the centraldogma-server-auth-shiro module backed by Apache Shiro. The vulnerable class, SearchFirstActiveDirectoryRealm, constructs an LDAP search filter by directly substituting the user-supplied login name into a filter string - e.g., (sAMAccountName=<input>) - without neutralizing LDAP filter metacharacters such as *, (, ), \, and NUL. This is a classic LDAP injection flaw (aligned with CWE-90: Improper Neutralization of Special Elements in an LDAP Query, though NVD has not formally assigned a CWE). By injecting crafted metacharacters, an attacker can rewrite filter logic to match unintended directory objects, confuse the authentication decision, or probe the AD tree structure through differential responses. The CPE cpe:2.3:a:ly_corporation:central_dogma:*:*:*:*:*:*:*:* covers all pre-0.84.0 releases.

RemediationAI

Upgrade centraldogma-server-auth-shiro to version 0.84.0 or later, which is the vendor-released patch confirmed by LY Corporation's advisory GHSA-98q5-5qh2-7w75 (https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75) and the EUVD entry EUVD-2026-38208. If immediate upgrade is not possible, a targeted compensating control is to disable the SearchFirstActiveDirectoryRealm and switch to a non-LDAP authentication backend (e.g., local account or OAuth), accepting the trade-off of temporarily losing Active Directory integration. Alternatively, place a WAF rule or reverse-proxy filter that rejects login requests containing LDAP metacharacters (*, (, ), \, NUL) in the username field - note this may block legitimate usernames containing parentheses in rare AD environments. Network-level restriction of the Central Dogma authentication endpoint to trusted internal IP ranges reduces exposure without requiring application changes.