Vulnerability · Published Jun 22, 2026 · Assigned by LY-Corporation
CVE-2026-11746
Critical 9.4
In plain English
A critical-severity hard-coded credentials in Central Dogma from LY Corporation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.linecorp.centraldogma:centraldogma-server | 0.84.0 | GHSA-2j95-gqxf-v3vg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LY Corporation | Central Dogma | see references |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H