https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 15:45:20 +0000 https://vulnerability.circl.lu/sighting/3a764fcd-bfec-401b-9c29-2c3f6a598b6f/export {"uuid": "3a764fcd-bfec-401b-9c29-2c3f6a598b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11746", "type": "seen", "source": "https://gist.github.com/alon710/bd396251a8687bea5416d129d9cb5f66", "content": "# CVE-2026-11746: CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server\n\n> **CVSS Score:** 9.4\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-11746\n\n## Summary\nCVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.\n\n## TL;DR\nUnauthenticated remote attackers with access to Central Dogma's replication ports can take over the cluster by authenticating with the default hard-coded replication secret 'ch4n63m3'.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-798\n- **Attack Vector**: Adjacent Network\n- **CVSS v4.0 Score**: 9.4 (Critical)\n- **EPSS Score**: 0.00229\n- **Impact**: Complete Cluster Takeover / Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Central Dogma Server\n\n## Mitigation\n\n- Upgrade Central Dogma Server to version 0.84.0 or above to enforce secure cryptographic secrets on startup.\n- Explicitly configure a strong, random 'replication.secret' of at least 16 characters in dogma.json on all nodes.\n- Implement host-based firewalls or security groups to strictly isolate replication ports from unauthorized network segments.\n\n**Remediation Steps:**\n1. Verify the current running version of Central Dogma Server and retrieve the dogma.json configuration.\n2. Generate a secure 32-character hex secret using 'openssl rand -hex 32'.\n3. Update dogma.json on every replica cluster node to include the generated secret within the 'replication' block.\n4. Upgrade the Central Dogma server installations to version 0.84.0 or later.\n5. Restart the services and verify the log output to confirm that the configuration is loaded securely.\n\n## References\n\n- [GitHub Security Advisory GHSA-2j95-gqxf-v3vg](https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg)\n- [Fix Commit](https://github.com/line/centraldogma/commit/a38baa1f162ce7417ee0d7317a036fd52f3cd844)\n- [v0.84.0 Release Changelog](https://github.com/line/centraldogma/commit/09b5db8bd2f16394bfc21097e77d720d3103b8b6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-11746) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T03:31:29.284057Z"} {"uuid": "3a764fcd-bfec-401b-9c29-2c3f6a598b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11746", "type": "seen", "source": "https://gist.github.com/alon710/bd396251a8687bea5416d129d9cb5f66", "content": "# CVE-2026-11746: CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server\n\n> **CVSS Score:** 9.4\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-11746\n\n## Summary\nCVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.\n\n## TL;DR\nUnauthenticated remote attackers with access to Central Dogma's replication ports can take over the cluster by authenticating with the default hard-coded replication secret 'ch4n63m3'.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-798\n- **Attack Vector**: Adjacent Network\n- **CVSS v4.0 Score**: 9.4 (Critical)\n- **EPSS Score**: 0.00229\n- **Impact**: Complete Cluster Takeover / Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Central Dogma Server\n\n## Mitigation\n\n- Upgrade Central Dogma Server to version 0.84.0 or above to enforce secure cryptographic secrets on startup.\n- Explicitly configure a strong, random 'replication.secret' of at least 16 characters in dogma.json on all nodes.\n- Implement host-based firewalls or security groups to strictly isolate replication ports from unauthorized network segments.\n\n**Remediation Steps:**\n1. Verify the current running version of Central Dogma Server and retrieve the dogma.json configuration.\n2. Generate a secure 32-character hex secret using 'openssl rand -hex 32'.\n3. Update dogma.json on every replica cluster node to include the generated secret within the 'replication' block.\n4. Upgrade the Central Dogma server installations to version 0.84.0 or later.\n5. Restart the services and verify the log output to confirm that the configuration is loaded securely.\n\n## References\n\n- [GitHub Security Advisory GHSA-2j95-gqxf-v3vg](https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg)\n- [Fix Commit](https://github.com/line/centraldogma/commit/a38baa1f162ce7417ee0d7317a036fd52f3cd844)\n- [v0.84.0 Release Changelog](https://github.com/line/centraldogma/commit/09b5db8bd2f16394bfc21097e77d720d3103b8b6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-11746) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T03:31:29.284057Z"} https://vulnerability.circl.lu/sighting/3a764fcd-bfec-401b-9c29-2c3f6a598b6f/export Sat, 12 Sep 2026 03:31:29 +0000 https://vulnerability.circl.lu/sighting/443fe8ed-70a9-401b-a74c-4b6a03771297/export {"uuid": "443fe8ed-70a9-401b-a74c-4b6a03771297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-11746", "type": "published-proof-of-concept", "source": "https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg", "content": "", "creation_timestamp": "2026-09-11T22:37:25.982210Z"} {"uuid": "443fe8ed-70a9-401b-a74c-4b6a03771297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-11746", "type": "published-proof-of-concept", "source": "https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg", "content": "", "creation_timestamp": "2026-09-11T22:37:25.982210Z"} https://vulnerability.circl.lu/sighting/443fe8ed-70a9-401b-a74c-4b6a03771297/export Fri, 11 Sep 2026 22:37:25 +0000 https://vulnerability.circl.lu/sighting/3892dadd-a3b1-41bb-b072-1515861f7143/export {"uuid": "3892dadd-a3b1-41bb-b072-1515861f7143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11746", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvbjqqanfy2g", "content": "CVE-2026-11746 - com.linecorp.centraldogma:centraldogma-server\nThe Central Dogma server uses a hard\u2011coded password (\u201cch4n63m3\u201d) for its built\u2011in ZooKeeper communication if administrators do not set their own secret.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#Java #CVE #infosec", "creation_timestamp": "2026-09-11T21:40:05.024723Z"} {"uuid": "3892dadd-a3b1-41bb-b072-1515861f7143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11746", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvbjqqanfy2g", "content": "CVE-2026-11746 - com.linecorp.centraldogma:centraldogma-server\nThe Central Dogma server uses a hard\u2011coded password (\u201cch4n63m3\u201d) for its built\u2011in ZooKeeper communication if administrators do not set their own secret.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#Java #CVE #infosec", "creation_timestamp": "2026-09-11T21:40:05.024723Z"} https://vulnerability.circl.lu/sighting/3892dadd-a3b1-41bb-b072-1515861f7143/export Fri, 11 Sep 2026 21:40:05 +0000