CVE-2026-11745

The record

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

Affected packages

Related vulnerabilities

• CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because… CWE-322
• CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync… CWE-322
• CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… CWE-322
• CVE-2026-18654 Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS… CWE-322
• CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key… CWE-322
• GHSA-mxg3-432p-mr72 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled… CWE-322
• CVE-2026-44467 The Claude Desktop app gives you Claude Code with a graphical interface built for running… CWE-322
• CVE-2026-1354 Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a… CWE-322