Live › vulnerability › CVE-2026-118991
CallBackery, a Perl configuration tool, encrypts its backups with a key made by padding the password with 'x' characters, with no salt or key derivation. An attacker who obtains a backup can guess the password quickly offline and then read every credential the backup holds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams that run CallBackery for Perl and keep its encrypted configuration backups. The risk needs someone to obtain a backup file, so exposure depends on where backups are stored and who can read them. Teams not running CallBackery can skip it.
No product ranges from the sources yet.
unknown if the sources do not give the command.0.62.0.0.62.0 are affected; move to 0.62.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.
getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.
An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.
This page as .md · .json · in your agent: get_signal("CVE-2026-118991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.