Dashboard / CVE-2026-11746

CVE-2026-11746

CRITICAL
INFO Priority: 0.02 BB Relevance: 64/100
Published: 2026-06-22 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

Weakness Classification (1)

References & Advisories (1)

Bug Bounty Relevance

64 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.23%
Raw Score 0.002270
Percentile 13.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00227
2026-10-28
0.00227

Intelligence Sources

nvd ref →

External Links