CVE-2026-11745 is a vulnerability in the centraldogma-server-mirror-git component of LY Corporation's Central Dogma product. Versions prior to 0.84.0 do not verify remote host keys when connecting via git+ssh://, enabling an attacker positioned on the network path to intercept and manipulate mirrored Git repositories through man-in-the-middle attacks. This vulnerability relates to improper key management (CWE-322). No official remediation or patch information is currently available.

An attacker capable of intercepting network traffic between the Central Dogma Git mirror client and the remote Git server can exploit this vulnerability to perform man-in-the-middle attacks. This can lead to compromise of the integrity and confidentiality of mirrored repositories, potentially allowing unauthorized code injection or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider alternative secure methods for mirroring Git repositories or implement network-level protections to prevent man-in-the-middle attacks on git+ssh:// connections.