Central Dogma Maven Package: Hard-coded Secret Vulnerability
- Severity
- HIGH
- Affected component
- centraldogma (maven)
- Patched version
- Not yet available
An early warning has been issued regarding a high-severity vulnerability in the Central Dogma Maven package. The package reportedly contains a hard-coded secret used for authentication, which could enable cluster takeover.
What happened
The Central Dogma Maven package is under investigation for containing a hard-coded secret, 'ch4n63m3', which is used for authentication in both client-facing and inter-peer SASL contexts. This secret has a silent fallback mechanism, which could potentially allow an attacker to take over a cluster. The vulnerability, tracked as GHSA-2J95-GQXF-V3VG and CVE-2026-11746, was first flagged on September 11, 2026. There is no authoritative version range published yet, and the vulnerability has not been exploited in the wild.
Professionals using Central Dogma should assess their exposure by checking if their installations include the affected package. The primary sources indicate that the hard-coded secret is present in the package, but the exact versions affected are not specified. It is recommended to upgrade to a version that removes the hard-coded secret and to rotate the secret in any affected environments.
What to do about it
- Check your Central Dogma installations for the presence of the hard-coded secret 'ch4n63m3'.
- Upgrade to a version of Central Dogma that removes the hard-coded secret.
- Rotate the secret in all affected environments to mitigate potential risks.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Consult the primary sources for the most current information and recommendations.
How 0Day would have caught this
centraldogma is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Central Dogma Maven package, you may be affected. The exact versions impacted are not specified, so it is advisable to check for the presence of the hard-coded secret 'ch4n63m3'.
What should I do right now?
Immediately check your Central Dogma installations for the hard-coded secret. Upgrade to a version that removes the secret and rotate it in affected environments. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for any updates on patched versions.