Central Dogma Git mirror trusts any SSH host key

LINE's Central Dogma, a configuration store used by microservices, ships a Git mirror client that never checks the identity of the remote SSH server it connects to. The flaw, tracked as CVE-2026-11745 and published as GitHub advisory GHSA-vjfw-cpmh-xwv3 on 11 September 2026, affects the Maven package com.linecorp.centraldogma:centraldogma-server-mirror-git. The advisory says the reporter confirmed the behaviour on 21 May 2026 against the main branch at commit d64a5151.

According to the advisory, the class SshGitMirror builds an Apache MINA SSHD client and installs a server key verifier lambda that returns true unconditionally. Two adjacent lines disable the usual fallbacks by setting an empty host config entry resolver and a no-op file system factory, which rules out known_hosts and ~/.ssh/config. The advisory states that a repository-wide search found no host-key pinning mechanism anywhere in the server-mirror-git module, and that operators have no opt-in way to turn verification on. Every outbound mirror connection using git+ssh:// blindly trusts whatever host key the remote presents.

The reporter says a multi-agent code audit verified that no operator-facing pinning field exists on SshKeyCredential, PasswordCredential or MirrorContext. A proof of concept was reproduced locally using a paramiko-based fake SSH server bound to 127.0.0.1. The fake server presented an ephemeral RSA host key that the client had never seen before; the Central Dogma mirror client accepted the connection and proceeded to authentication, logging the offered username and public-key fingerprint. The advisory notes that a correctly hardened SSH client would refuse the connection before reaching the authentication phase. The PoC artefacts are described as read-only and loopback-only, held on the reporter's workstation.

The threat model in the advisory is an on-path attacker on a corporate network. Listed positions include ARP spoofing on the LAN, internal DNS poisoning that overrides github.com or a configured internal git hostname, BGP hijack, a compromised sidecar or CNI component in Kubernetes, or any process able to answer TCP on the resolved IP address. No Central Dogma account is required, only network position.

The consequences differ by mirror direction. For LOCAL_TO_REMOTE mirrors, an attacker impersonating the remote git server receives the entire mirrored repository over the SSH session. Because Central Dogma is a configuration store, the advisory says this typically means database credentials, third-party API keys, certificates and feature flags. For REMOTE_TO_LOCAL mirrors, the attacker can serve arbitrary commits, which Central Dogma materialises into the local repository and then broadcasts to every subscribing microservice through the watch API. The advisory describes this as a supply-chain root-of-trust compromise across downstream services. It also links the issue to a separate finding, H2, in which mirror credentials are not bound to a hostname, meaning a key or token configured for github.com could be captured by a fake server and replayed against the real upstream. CVSS scope is rated Changed for that reason.

The advisory's suggested fix is to add an acceptedHostKeys list of SHA-256 fingerprints to the credential types, replace the accept-all lambda with a constant-time fingerprint comparison, and fail closed when the list is empty rather than implementing implicit trust-on-first-use. It also suggests an admin-only tool to probe and print a remote's fingerprint as an audited one-off, and updating the existing mirror tests to pin a fingerprint so the flaw cannot silently return. The incident record lists the status as reported.