https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:32:59.373128+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328989 EUVD-2026-328989 2026-10-06T10:32:59.423096+00:00 EUVD-2026-328989 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11745 fkie_cve-2026-11745 2026-10-06T10:32:59.423142+00:00

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

 https://cve.radiocsirt.org/vuln/ghsa-vjfw-cpmh-xwv3 GHSA-vjfw-cpmh-xwv3 — Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror) 2026-10-06T10:32:59.423179+00:00

Affected: Maven: com.linecorp.centraldogma:centraldogma-server-mirror-git

# Vulnerability

Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally for every outbound SSH connection used by `git+ssh://` mirrors. The accompanying lines disable the `known_hosts` and `~/.ssh/config` fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no `acceptedHostKeys`, `knownHosts`, `KnownHostsServerKeyVerifier`, `StaticServerKeyVerifier`, or `RequiredServerKeyVerifier`) exists anywhere in `server-mirror-git/`. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents.

## Evidence

File: `server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java` Lines 143-160 (especially 149) on branch `main` @ commit `d64a5151`:

```java private SshClient createSshClient() { final ClientBuilder builder = ClientBuilder.builder(); // Do not use local file system. builder.hostConfigEntryResolver(HostConfigEntryResolver.EMPTY); // line 146 builder.fileSystemFactory(NoneFileSystemFactory.INSTANCE); // line 147 // Do not verify the server key. builder.serverKeyVerifier((clientSession, remoteAddress, serverKey) -> true); // line 149 ... } ```

Verification:

- Read confirmed on 2026-05-21 against `main` @ `d64a5151`. - A multi-agent code audit verified that no operator-facing pinning field exists on `SshKeyCredential`, `Password…