CVE-2026-11745
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections. This allows an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
Risk Assessment
The organization is at risk of man-in-the-middle attacks, which could lead to the compromise of data in mirrored repositories and loss of trust in the system.
Recommendation
It is recommended to update centraldogma-server-mirror-git to version 0.84.0 or later to ensure verification of remote host keys.
Original NVD description (English source)
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.