Central Dogma EUVD-2026-38206

Exploitation requires (1) Central Dogma operators to have configured at least one Git mirror source using the git+ssh:// scheme - HTTPS mirrors and locally configured repositories are not affected; (2) the attacker to occupy an on-path network position between the Central Dogma server and the upstream SSH Git endpoint at the moment the mirror pull occurs (captured by AV:A and AT:P in the vendor vector); and (3) the running centraldogma-server-mirror-git version to be earlier than 0.84.0. No authentication to Central Dogma itself, no credentials for the upstream Git server, and no interaction from any human user are required, which is what drives the high base score despite the on-path gating.

The vendor-supplied CVSS 4.0 score of 8.8 reflects unauthenticated, no-interaction exploitation (PR:N/UI:N) with high confidentiality and integrity impact on both the vulnerable and subsequent systems (VC:H/VI:H, SC:H/SI:H) - appropriate because compromised mirrored repos cascade into every consumer of the configuration data. However, AV:A plus AT:P explicitly captures that exploitation is gated on the attacker holding an on-path position relative to git+ssh:// traffic, which substantially limits the realistic population of attackers compared with an internet-reachable RCE. EPSS, KEV status, and public exploit availability are not present in the supplied intelligence; absence of a KEV listing combined with no public PoC suggests this is not currently being mass-exploited, but the high integrity impact on configuration-management infrastructure makes it a meaningful priority for any deployment whose Central Dogma server reaches upstream Git over untrusted network paths. CWE is reported as N/A in the input, so the root-cause class is inferred from the description rather than vendor-assigned.

An attacker who controls a hop between the Central Dogma server and its upstream Git host - for example a compromised router, a rogue Wi-Fi or VPN gateway, or an internal pivot - intercepts the outbound SSH handshake for a git+ssh:// mirror pull and presents their own SSH host key, which the client accepts without complaint. The attacker proxies traffic to the real server while substituting commits that, for instance, change a feature flag, inject a malicious config value, or alter a Kubernetes manifest, and Central Dogma replicates the poisoned content to every consuming service. No public exploit identified at time of analysis, but the technique requires only a standard SSH MITM toolkit.