Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

published 2026-06-22 4 mo ago modified 2026-10-25 14 d ago also GHSA-2j95-gqxf-v3vg , EUVD-2026-38207

cvss: 9.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

Patch / fix

fixed in 2

maven com.linecorp.centraldogma:centraldogma-server 0.84.0
LY Corporation Central Dogma 0.84.0

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-22)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	9.4	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
maven	com.linecorp.centraldogma:centraldogma-server	<0.84.0	0.84.0

Affected products

LY Corporation Central Dogma

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

github.com /line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg
exploit, web
nvd.nist.gov /vuln/detail/CVE-2026-11746
advisory
github.com /line/centraldogma
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary