The vulnerability arises because the Git mirror SSH client in Central Dogma does not verify remote host keys for git+ssh connections. As a result, an on‑path attacker can perform a man‑in‑the‑middle attack and intercept or modify the data exchanged during repository mirroring. The attacker could potentially alter the contents of the mirrored repository, insert malicious commits or otherwise compromise the integrity of the code base. While the CVE description does not explicitly state the exact manipulation possible, it is inferred that tampering could occur.

Affected vendors and products: LY Corporation’s Central Dogma server. Versions prior to 0.84.0 of the centraldogma‑server‑mirror‑git component are vulnerable; no additional version information is provided.

The CVSS score of 8.8 indicates a high‑severity issue. The EPSS score is not available, but the lack of host key verification means that a network attacker who can intercept git+ssh traffic can exploit this flaw. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can control the server Central Dogma contacts for mirroring can serve a malicious copy of the repository, effectively compromising repository integrity.