{"cve":"CVE-2026-11746","nvd":{"published":"2026-06-22T03:16:42.833","modified":"2026-10-25T23:10:00.167","status":"Deferred","description":"A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4},"cvss_v3":null,"cwes":["CWE-798"],"references":["https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg","https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg"],"products":[],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-11746","score":0.00229,"percentile":0.13537,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-2j95-gqxf-v3vg","url":"https://osv.dev/vulnerability/GHSA-2j95-gqxf-v3vg","summary":"Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover","modified":"2026-09-11T21:00:06.361009618Z","packages":[{"ecosystem":"Maven","name":"com.linecorp.centraldogma:centraldogma-server","purl":"pkg:maven/com.linecorp.centraldogma/centraldogma-server","ranges":["<0.84.0"],"fixed":["0.84.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}