Use of hard-coded credentials in Central Dogma - CVE-2026-11746

Detailed vulnerability description

The vulnerability allows a remote user to join the embedded ZooKeeper quorum, read replication logs, and execute arbitrary commands across the cluster.

The vulnerability exists due to use of hard-coded credentials in ZooKeeperReplicationConfig.secret() and the embedded ZooKeeper SASL configuration when ZooKeeper replication is enabled without replication.secret configured. A remote user can authenticate with the hard-coded secret and impersonate a peer or access the embedded ZooKeeper surfaces to join the embedded ZooKeeper quorum, read replication logs, and execute arbitrary commands across the cluster.

The issue applies when replication.method is set to ZOOKEEPER; standalone deployments using NONE are not affected. The same secret is used for both client-facing SASL and quorum or learner SASL contexts.

How to mitigate CVE-2026-11746

Sources

• https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg
• https://github.com/line/centraldogma/commit/d64a5151