Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Published September 11, 2026 CVE-2026-11746

Central Dogma is a server companies use to store and sync configuration files across a cluster. If an admin turns on its replication feature but forgets to set a security key, the software quietly falls back to a public, well-known password, letting an attacker with network access read all its data or take over the whole cluster.

Severity
CriticalCVSS 4.0 · 9.4 · linecorp.com
Fix
Fixed in 0.84.0Fix recorded today
Affected versions
before 0.84.0
Weakness
CWE-798Use of Hard-coded Credentials
Exploit likelihood
0.23% in 30 daysEPSS, higher than 14% of known flaws
Affects
Central Dogma

How it works

  • An administrator turns on Central Dogma's ZooKeeper-based replication mode so multiple servers can stay in sync.
  • If that admin does not set the replication.secret option, the software does not stop or warn.
  • It silently substitutes a fixed password, "ch4n63m3", that is written directly in Central Dogma's own public source code.
  • That same password protects both the connection used to read data locally and the connection between cluster members.
  • Anyone who can reach that connection, whether on the same machine or over the network the cluster replicas use to talk to each other, can log in with the known password.
  • Once inside, they can read the entire replication history, and in some cluster setups can also send commands that every server in the cluster will carry out.

What to do

If you run a Central Dogma cluster with replication.method set to ZOOKEEPER, check your configuration file for whether replication.secret is set at all. Compare your installed centraldogma-server version against 0.84.0 in the official advisory. Versions before that number are affected only when ZooKeeper replication is enabled. Standalone Central Dogma servers that do not use replication.method ZOOKEEPER are not exposed to this issue.

Update centraldogma-server to version 0.84.0 or later, which removes the built-in fallback password and refuses to start unless an operator sets a real, non-placeholder secret. Set replication.secret to a freshly generated random value of at least 32 characters on every replica if you must run an older version in the meantime. Watch the GitHub advisory for guidance on auditing replicated commands and rotating credentials if the old default password may have been reachable on your network.

Technical details

In ZooKeeper replication mode, every Central Dogma replica embeds its own ZooKeeper instance, so the cluster's inter-replica network effectively is the ZooKeeper network. Before version 0.84.0, ZooKeeperReplicationConfig.secret returned the hard-coded string "ch4n63m3" whenever replication.secret was left unset in the config, with no log message or warning. That same value authenticated both the local client port and the quorum connections between replicas, so one leaked or guessed password reached both surfaces. Version 0.84.0 removes the default value entirely and requires operators to set an explicit secret of at least 32 characters, rejecting the old placeholder if it is reused.

Severity breakdown

  • Attack vector Adjacent Needs access to the same local network
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure High Sensitive data can be exposed with serious impact
  • Other systems: Data changes High Protected data can be changed with serious impact
  • Other systems: Service disruption High Severe or persistent loss of service in another system
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source