CVE-2026-11746_CVE-2026-11746

9.4 / 10

CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Description

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

AI Analysis

Vulnerability in Central Dogma server allowing attackers to read or execute commands due to a hardcoded secret

Basic Information

ID CVE-2026-11746

Source LY-Corporation

Published Jun 22, 2026 at 02:35

Affected Product

Vendor LY Corporation

Product Central Dogma

Version 0.84.0

AI Assessment

AI Score 9.4 / 10

AI Severity Critical

Vendor LY Corporation

Product Central Dogma

Version < 0.84.0

References

github.com /line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg

{
    "lastseen": "",
    "description": "A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.",
    "published": "2026-06-22T02:35:51.201Z",
    "modified": "2026-06-22T02:35:51.201Z",
    "type": "cve",
    "title": "CVE-2026-11746",
    "source": "LY-Corporation",
    "references": "https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg",
    "id": "CVE-2026-11746",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "",
    "sourceHref": "",
    "cvss": {
        "score": 9.4,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Central Dogma",
    "version": "0.84.0",
    "vendor": "LY Corporation",
    "ai_description": "Vulnerability in Central Dogma server allowing attackers to read or execute commands due to a hardcoded secret",
    "ai_severity": "Critical",
    "ai_vendor": "LY Corporation",
    "ai_product": "Central Dogma",
    "ai_version": "< 0.84.0",
    "ai_score": 9.4
}