Central Dogma CVE-2026-11748

Exploitation requires that the Central Dogma deployment has explicitly configured the SearchFirstActiveDirectoryRealm as its authentication mechanism, meaning Active Directory or LDAP-backed login must be enabled - this is not the default out-of-the-box configuration and requires deliberate administrator setup. Beyond that single configuration prerequisite, the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no further conditions: no authentication, no user interaction, no special network position, and no elevated complexity are required. Exploitation is limited to the authentication confusion and directory enumeration impact; there is no indicated path to remote code execution or full credential bypass from description data alone. Deployments that authenticate via local accounts, OAuth, or other non-LDAP mechanisms are entirely unaffected.

The CVSS 4.0 score of 6.9 (Medium) is driven by a fully network-accessible, zero-complexity, unauthenticated attack surface (AV:N/AC:L/AT:N/PR:N/UI:N), tempered by limited impact metrics (VC:L/VI:L/VA:N/SC:L/SI:N/SA:N). The limited confidentiality and integrity ratings reflect that exploitation yields directory enumeration and authentication confusion rather than full credential disclosure or code execution. The SC:L (subsequent-system confidentiality impact) appropriately captures leakage of LDAP/AD structure beyond the Central Dogma process itself. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. Despite the moderate numeric score, the PR:N/UI:N combination means any internet-exposed Central Dogma instance using LDAP authentication is an attractive low-effort target for reconnaissance - real-world risk is elevated if the AD structure reveals privileged account names or group memberships. Defenders should treat this as a high priority for patching given the zero-barrier exploitation path, even absent KEV confirmation.

An unauthenticated attacker targeting an internet-exposed Central Dogma instance sends a series of login requests with crafted usernames such as admin)(|(uid=* or *)(objectClass=* to rewrite the LDAP filter constructed by SearchFirstActiveDirectoryRealm. By observing differences in authentication responses, the attacker enumerates valid AD usernames, group memberships, and OU structure without holding any credentials. No public proof-of-concept has been identified, but LDAP injection techniques of this class are well-documented and require no specialized tooling.