CVE Intelligence
Analysis AI-assisted

CVE-2026-11746: centraldogma-server hard-coded default secret in ZooKeeper replication

centraldogma-server versions prior to 0.84.0 fall back to a hard-coded, publicly known secret when ZooKeeper replication is enabled without replication.secret. The record states that an attacker with network access could read the replication log or join the quorum to run replicated commands. The CNA rates this critical with a CVSS 4.0 base score of 9.4, and the record shows no KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A vulnerability in centraldogma-server affects versions prior to 0.84.0 when ZooKeeper replication is enabled without setting replication.secret. In that configuration the server silently uses a hard-coded, publicly known secret to authenticate its embedded ZooKeeper ensemble.

Impact

  • An attacker with network access to the affected service could read the full replication log.
  • The same attacker could join the quorum and run arbitrary replicated commands across the cluster.
  • The CNA rates the issue as critical with a CVSS 4.0 base score of 9.4, reflecting high confidentiality, integrity and availability impact.

Affected products and versions

  • centraldogma-server versions prior to 0.84.0, when ZooKeeper replication is enabled and replication.secret is not set.
  • The record contains no structured affected or fixed version entries, so the exact scope should be confirmed in the GitHub security advisory.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • No EPSS data is present in the record.

Remediation and mitigation

  • Plan an upgrade of centraldogma-server to version 0.84.0 or later. This is inferred from the upper boundary of the affected range, since the record does not explicitly describe the fixed release.
  • Until an upgrade is possible, define a unique, strong replication.secret value whenever ZooKeeper replication is enabled, so the server does not fall back to the default secret.
  • Restrict network access to the ZooKeeper replication ports so that only trusted cluster members can reach them.
  • Review whether any deployment has run with replication enabled and no custom secret, and treat those environments as exposed until remediated.

Detection guidance

  • Review configuration files and deployment manifests for ZooKeeper replication being enabled without a replication.secret entry.
  • Monitor traffic to the embedded ZooKeeper ports for connections originating from hosts that are not known cluster members.
  • After upgrading or changing configuration, verify that each cluster uses a custom replication secret.

Limitations of the available information

  • The record provides no structured fixed-version data and no details beyond the prior to 0.84.0 boundary.
  • The record gives no information about exploitation in the wild beyond the KEV status.
  • The source_status field is set to Deferred, and the record does not explain what this means.
  • Port numbers, default behaviour in other releases, and whether logs or configuration exposures could reveal the secret are not stated in the record.

Frequently asked questions

Is this CVE being exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

What should administrators do first?

Identify deployments that have ZooKeeper replication enabled, set a unique replication.secret value, and plan an upgrade to version 0.84.0 or later.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.