CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server

Central Dogma is a highly-available, version-controlled service configuration repository developed by LY Corporation. In distributed multi-node environments, the service relies on an embedded ZooKeeper cluster to orchestrate replication logs and ensure state synchronization across replicas. Because the underlying storage layer contains sensitive service configurations, credentials, and cryptographic keys, security within the inter-peer synchronization channel is critical.\n\nPrior to version 0.84.0, the replication mechanism contained a flaw where the failure to explicitly set a replication secret in the configuration file caused the server to fall back to a hard-coded default value. This default credential, "ch4n63m3", was compiled directly into the application server code. Consequently, any deployment that left the replication.secret field unconfigured or null remained accessible using this globally known secret key.\n\nThe vulnerability is classified as CWE-798: Use of Hard-coded Credentials. Because the embedded ZooKeeper peer ports frequently bind to external network interfaces to facilitate multi-host clustering, this configuration flaw exposes a significant network-facing attack surface. Unauthorized entities on an adjacent network can leverage this default secret to authenticate directly to the coordination ensemble.

The core of this vulnerability lies in how configuration variables are parsed and validated within ZooKeeperReplicationConfig.java. During the initialization of the replication engine, the application is designed to retrieve configuration parameters from the dogma.json file. If the replication.secret parameter is missing or evaluates to null, the parsing logic does not trigger an exception or halt execution.\n\nInstead, the program employs a fallback utility, firstNonNull, to ensure that a non-null string is returned to the JAAS and SASL authentication providers. The code-level configuration parser returns the static constant DEFAULT_SECRET, which is set to the ASCII string "ch4n63m3". This fail-open implementation allows the server to establish an authenticated transport layer using credentials that are publicly visible in the open-source repository.\n\nThis configuration pattern fails to enforce standard cryptographic hygiene during system bootstrap. No automated checks exist in the vulnerable version to verify the entropy, length, or uniqueness of the configuration secret. The system proceeds to open listeners on the configured quorum and election ports, presenting an apparently secure SASL-authenticated channel that is actually protected only by a known default string.

The transition from vulnerable to patched code in ZooKeeperReplicationConfig.java demonstrates the shift from a passive fallback mechanism to an active validation routine. In the vulnerable version, the retrieval of the replication secret was managed by a single-line fallback statement. This implementation did not inspect the origin or strength of the returned string before passing it to the authentication framework.\n\njava\n// Vulnerable Implementation\nprivate static final String DEFAULT_SECRET = "ch4n63m3";\n\npublic String secret() {\n // If "replication.secret" is null, firstNonNull silently returns "ch4n63m3"\n return firstNonNull(convertValue(secret, "replication.secret"), DEFAULT_SECRET);\n}\n\n\nThe patched implementation introduced in commit a38baa1f162ce7417ee0d7317a036fd52f3cd844 eliminates this silent fallback behavior by enforcing a minimum length of 16 characters during server startup. If the configured secret fails to meet this requirement, the constructor throws an exception and prevents the replication port from binding unless an explicit override parameter is set.\n\njava\n// Patched Implementation\nstatic final int MINIMUM_SECRET_LENGTH = 16;\nprivate static final String DEFAULT_SECRET = "ch4n63m3";\n\npublic String secret() {\n final String resolved = convertValue(secret, "replication.secret");\n if (resolved != null) {\n return resolved;\n }\n // Only reachable when allowInsecureSecret is true and secret is null.\n return DEFAULT_SECRET;\n}\n\n// Validation logic in constructor\nfinal boolean allowInsecureSecret0 = Boolean.TRUE.equals(allowInsecureSecret);\nthis.secret = secret;\nfinal String resolved = secret();\nif (!allowInsecureSecret0) {\n checkArgument(resolved.length() >= MINIMUM_SECRET_LENGTH,\n "'replication.secret' must be at least %s characters long.", MINIMUM_SECRET_LENGTH);\n}\n

Exploitation of CVE-2026-11746 requires network access to the ports designated for ZooKeeper peer-to-peer communication. An attacker must first perform network-level reconnaissance to identify active listeners on the replication ports, which are defined in the cluster's configuration block. Because the targets are standard TCP sockets used for leader election and quorum synchronization, they are easily distinguished.\n\nOnce the target ports are identified, the attacker configures a standard ZooKeeper client or helper tool to connect using the SASL mechanism. The client's Java Authentication and Authorization Service (JAAS) configuration is defined to supply the username super or a known cluster replica identifier. The password field is populated with the hard-coded default string "ch4n63m3".\n\nUpon successful authentication, the malicious node is accepted into the replication ensemble as a valid peer. The attacker can then issue synchronization commands to read transaction logs or write state modifications. Because the replication protocol trusts authenticated peers implicitly, the database state of the entire cluster can be altered without secondary validation.\n\nmermaid\ngraph LR\n Attacker["Attacker Node"] -->|"Authenticate with 'ch4n63m3'"| Node1["Vulnerable Central Dogma Node"]\n Node1 -->|"Join Consensus"| Quorum["ZooKeeper Quorum"]\n Node2["Legitimate Node"] -->|"Sync State"| Quorum\n

The successful exploitation of this vulnerability has direct consequences for the confidentiality, integrity, and availability of the Central Dogma configuration store. Because Central Dogma often houses critical infrastructure secrets, such as API keys, database credentials, and SSL certificates, access to the replication logs allows an attacker to extract these materials in plaintext. This exposure can lead to lateral movement within the target enterprise network.\n\nIn terms of integrity, an attacker acting as an authenticated peer can inject arbitrary configurations or modify existing repository data. These unauthorized changes are automatically propagated to all client applications consuming configurations from Central Dogma. This vector allows for widespread application-level manipulation, potentially facilitating downstream remote code execution on client hosts.\n\nFinally, availability is severely impacted because the malicious peer can disrupt the consensus mechanism. By introducing desynchronized transaction histories or interrupting leader elections, the attacker can break the quorum. This action prevents legitimate nodes from reaching consensus, causing service degradation and denying configuration updates to dependent applications.

Remediation of CVE-2026-11746 requires updating the Central Dogma server deployment to version 0.84.0 or later. This upgrade modifies the configuration engine to enforce strong security policies by default, blocking the use of short or default secrets. Operators should verify that the application logs confirm a successful, secure configuration load following the update.\n\nWhen deploying the patched version, operators must generate a cryptographically secure replication secret of at least 16 characters. A secure hex string can be generated using standard operating system utilities. This secret must then be distributed securely to all participating replicas and defined in each node's dogma.json configuration file under the replication.secret key.\n\nTo provide defense-in-depth, network-level access controls must be implemented to isolate the peer communication ports. Firewall rules or network security groups should restrict connections to the quorumPort and electionPort so that only the IP addresses of authorized cluster replicas are permitted to connect. This isolation prevents exposure even in the event of credential-related misconfigurations.