CVE-2026-11745 Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
An on-path attacker can perform man-in-the-middle attacks on Git mirror SSH connections due to missing host key verification, compromising mirrored repositories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11745?
CVE-2026-11745 is a high-severity vulnerability in LY Corporation Central Dogma, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
Weakness: CWE-322
Which versions are affected by CVE-2026-11745?
2 open source packages ship an affected version, including com.linecorp.centraldogma:centraldogma-server-mirror-git.
| Package | Affected | Fixed in |
|---|---|---|
com.linecorp.centraldogma:centraldogma-server-mirror-git Maven | All versions | 0.84.0 |
com.linecorp.centraldogma:centraldogma-server-mirror-git Maven | All versions | 0.84.0 |
How do I fix CVE-2026-11745?
Upgrade com.linecorp.centraldogma:centraldogma-server-mirror-git to 0.84.0 or later.
Is CVE-2026-11745 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11745 exists.
Sources
Also known as GHSA-vjfw-cpmh-xwv3.