THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-2j95-gqxf-v3vg (critical) — Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

[GHSA] GHSA-2j95-gqxf-v3vg (critical) — Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

medgithub_advisoriesPublished 2026-09-11

GHSA-2j95-gqxf-v3vg Severity: critical CVE: CVE-2026-11746

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

## Vulnerability

`ZooKeeperReplicationConfig.secret()` silently substitutes the hard-coded constant `"ch4n63m3"` (leetspeak for "change me") whenever the operator omits `replication.secret`. The same secret is wired into both

MITRE ATT&CK techniques

CredentialsT1589.001
ImpersonationT1684.001
ImpersonationAML.T0073

Indicators of compromise

CVE-2026-11746cve

Original source: https://github.com/advisories/GHSA-2j95-gqxf-v3vg