Vulnerability
Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the known_hosts and ~/.ssh/config fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no acceptedHostKeys, knownHosts, KnownHostsServerKeyVerifier, StaticServerKeyVerifier, or RequiredServerKeyVerifier) exists anywhere in server-mirror-git/. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents.
Evidence
File: server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java
Lines 143-160 (especially 149) on branch main @ commit d64a5151:
private SshClient createSshClient() {
final ClientBuilder builder = ClientBuilder.builder();
// Do not use local file system.
builder.hostConfigEntryResolver(HostConfigEntryResolver.EMPTY); // line 146
builder.fileSystemFactory(NoneFileSystemFactory.INSTANCE); // line 147
// Do not verify the server key.
builder.serverKeyVerifier((clientSession, remoteAddress, serverKey) -> true); // line 149
...
}
Verification:
- Read confirmed on 2026-05-21 against
main @ d64a5151.
- A multi-agent code audit verified that no operator-facing pinning field exists on
SshKeyCredential, PasswordCredential, or MirrorContext.
- Exploit PoC reproduced locally with a
paramiko-based fake SSH server bound to 127.0.0.1. The fake server presents an ephemeral RSA host key never seen before; the Central Dogma mirror client accepts the connection and proceeds to authentication, logging the offered username and public-key fingerprint. A correctly hardened SSH client would refuse the connection before reaching the authentication phase.
- Full PoC artifacts (read-only, loopback-only) at
~/centraldogma-poc/C1_ssh_hostkey_bypass/ on the reporter's workstation.
Impact
Threat model: An on-path attacker on the corporate network — ARP spoofing on the LAN, internal DNS poisoning, malicious internal DNS overriding github.com or the configured internal git hostname, BGP hijack, sidecar/CNI compromise in Kubernetes, or any process able to answer TCP on the resolved IP. No Central Dogma account required; only network position.
- Direction
LOCAL_TO_REMOTE: the attacker impersonating the remote git server receives the entire mirrored repository contents over the SSH session. Central Dogma is a configuration store, so this typically exfiltrates DB credentials, third-party API keys, certificates, feature flags, and any other secret configuration committed to mirrored repositories.
- Direction
REMOTE_TO_LOCAL: the attacker can serve arbitrary commits which Central Dogma materializes into the local repo and then broadcasts to every subscribing microservice via the watch API. This is a supply-chain root-of-trust compromise across all downstream services consuming Central Dogma configuration.
- Credential theft chain with finding H2 (mirror credentials are not bound to a hostname): an SSH key or access token configured for
github.com can be captured by the attacker's fake server and replayed against the real upstream, extending impact beyond Central Dogma itself.
Scope is Changed (CVSS) because exploitation alters trust assumptions of every downstream client of Central Dogma, not just Central Dogma itself.
How to fix
- Add an
acceptedHostKeys: List<String> field to SshKeyCredential and PasswordCredential (or to MirrorContext). Values are SHA-256 fingerprints of trusted remote SSH server host keys, e.g. SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
- Replace the accept-all lambda at
SshGitMirror.java:149 with a verifier that computes the SHA-256 fingerprint of the presented host key and compares it against the credential's allowlist using a constant-time comparison.
- Refuse to connect when
acceptedHostKeys is empty — fail-closed. Do not implement implicit TOFU.
- Optionally provide an admin-only
dogma mirror probe-host-key <remote> tool that performs a single audited connection, prints the server's fingerprint, and prompts the operator to add it to the credential. This makes TOFU an explicit, audited operation.
- Update
SshGitMirrorTest.java and it/mirror/* tests to pin a test fingerprint or use the explicit trust-once tool, so the regression cannot silently return.
Vulnerability
Central Dogma's Git mirror SSH client installs an Apache MINA SSHD
ServerKeyVerifierlambda that returnstrueunconditionally for every outbound SSH connection used bygit+ssh://mirrors. The accompanying lines disable theknown_hostsand~/.ssh/configfallbacks, and a repo-wide search confirms that no host-key pinning mechanism (noacceptedHostKeys,knownHosts,KnownHostsServerKeyVerifier,StaticServerKeyVerifier, orRequiredServerKeyVerifier) exists anywhere inserver-mirror-git/. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents.Evidence
File:
server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.javaLines 143-160 (especially 149) on branch
main@ commitd64a5151:Verification:
main@d64a5151.SshKeyCredential,PasswordCredential, orMirrorContext.paramiko-based fake SSH server bound to 127.0.0.1. The fake server presents an ephemeral RSA host key never seen before; the Central Dogma mirror client accepts the connection and proceeds to authentication, logging the offered username and public-key fingerprint. A correctly hardened SSH client would refuse the connection before reaching the authentication phase.~/centraldogma-poc/C1_ssh_hostkey_bypass/on the reporter's workstation.Impact
Threat model: An on-path attacker on the corporate network — ARP spoofing on the LAN, internal DNS poisoning, malicious internal DNS overriding
github.comor the configured internal git hostname, BGP hijack, sidecar/CNI compromise in Kubernetes, or any process able to answer TCP on the resolved IP. No Central Dogma account required; only network position.LOCAL_TO_REMOTE: the attacker impersonating the remote git server receives the entire mirrored repository contents over the SSH session. Central Dogma is a configuration store, so this typically exfiltrates DB credentials, third-party API keys, certificates, feature flags, and any other secret configuration committed to mirrored repositories.REMOTE_TO_LOCAL: the attacker can serve arbitrary commits which Central Dogma materializes into the local repo and then broadcasts to every subscribing microservice via the watch API. This is a supply-chain root-of-trust compromise across all downstream services consuming Central Dogma configuration.github.comcan be captured by the attacker's fake server and replayed against the real upstream, extending impact beyond Central Dogma itself.Scope is
Changed(CVSS) because exploitation alters trust assumptions of every downstream client of Central Dogma, not just Central Dogma itself.How to fix
acceptedHostKeys: List<String>field toSshKeyCredentialandPasswordCredential(or toMirrorContext). Values are SHA-256 fingerprints of trusted remote SSH server host keys, e.g.SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.SshGitMirror.java:149with a verifier that computes the SHA-256 fingerprint of the presented host key and compares it against the credential's allowlist using a constant-time comparison.acceptedHostKeysis empty — fail-closed. Do not implement implicit TOFU.dogma mirror probe-host-key <remote>tool that performs a single audited connection, prints the server's fingerprint, and prompts the operator to add it to the credential. This makes TOFU an explicit, audited operation.SshGitMirrorTest.javaandit/mirror/*tests to pin a test fingerprint or use the explicit trust-once tool, so the regression cannot silently return.