CVE-2026-11746

ZooKeeper Replication Default Secret Exposes Full Replication Log and Arbitrary Command Execution

Published Jun 22, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Description

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

Analysis

Technical impact

A default, publicly known secret is used by Central Dogma when ZooKeeper replication is enabled without a custom \"replication.secret\" value. This hard‑coded credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the entire replication log or participate in the quorum and execute arbitrary replicated commands. The flaw exploits a hard‑coded credential weakness (CWE‑798) and results in the compromise of confidentiality, integrity, and availability of the replicated data.

Affected Systems

LY Corporation Central Dogma versions prior to 0.84.0 that have ZooKeeper replication enabled without setting a replication.secret. The vulnerability applies to all releases before 0.84.0 when this configuration is used.

Risk and Exploitability

The CVSS score of 9.4 signals critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the ZooKeeper or Central Dogma network is able to use the default secret to join the quorum and gain full control over replicated commands, effectively achieving remote code execution across the cluster.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LY Corporation

Central Dogma

affected

Version	Status	Constraints
`0.84.0`	unaffected	< *

No data.

Vendor Product Versions

Ly Corporation

Central Dogma

Version	Status	Scheme	Platform
`[0.84.0,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Central Dogma to version 0.84.0 or later, which removes the hard‑coded secret
If an upgrade cannot be performed immediately, disable ZooKeeper replication or configure a unique replication.secret to prevent use of the default credential
Monitor the ZooKeeper cluster for unauthorized connections and ensure the replication.secret is not set to the default value

Generated by OpenCVE AI on June 22, 2026 at 04:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-2j95-gqxf-v3vg	Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.227% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg

History

Jun 23, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ly Corporation Ly Corporation central Dogma
Vendors & Products		Ly Corporation Ly Corporation central Dogma

Jun 22, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 22, 2026 5:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		ZooKeeper Replication Default Secret Exposes Full Replication Log and Arbitrary Command Execution
Weaknesses		CWE-287 CWE-798

Jun 22, 2026 3:00 AM Description updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.
References		https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg
Metrics		cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`