High, CVSS 8.8MavenAmendedPublished
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
CVE-2026-11745 · GHSA-vjfw-cpmh-xwv3
- Affected
- Maven com.linecorp.centraldogma:centraldogma-server-mirror-git < 0.84.0
- Fixed in
- 0.84.0· Vendor fix available
- Issue
- Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and ~/.ssh/config fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no acceptedHostKeys, knownHosts, KnownHostsServerKeyVerifier, StaticServerKeyVerifier, or RequiredServerKeyVerifier) exists anywhere in server-mirror-git/. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents. Evidence File: server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java Lines 143-160 (especially 149) on branch main @ commit d64a5151: Verification: - Read confirmed on 2026-05-21 against main @ d64a5151. - A multi-agent code audit verified that no operator-facing pinning field exists on SshKeyCredential,…
Recommended action: Upgrade to 0.84.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.