CVE-2026-11745: Ly Corporation Central Dogma

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

Affected products

• Ly Corporation Central Dogma: before 0.84.0 (fixed in 0.84.0)

Published 2026-06-22. Last modified 2026-06-22.