HIGH GitHub
CVE-2026-11745
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
# Vulnerability
Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally for every outbound SSH connection used by `git+ssh://` mirrors. The accompanying lines disable the `known_hosts` and `~/.ssh/config` fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no `acceptedHostKeys`, `knownHosts`, `KnownHostsServerKeyVerifier`, `StaticServerKeyVerifier`, or `RequiredServerKeyVerifier`) exists anywher
Affected Products
- maven/com.linecorp.centraldogma:centraldogma-server-mirror-git < 0.84.0
References
- https://github.com/advisories/GHSA-vjfw-cpmh-xwv3
- https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3
- https://nvd.nist.gov/vuln/detail/CVE-2026-11745
- https://github.com/advisories/GHSA-vjfw-cpmh-xwv3
This high severity vulnerability was published on 2026-09-11 via GitHub. Affected: maven/com.linecorp.centraldogma:centraldogma-server-mirror-git < 0.84.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.