Live › vulnerability › CVE-2026-118994
CallBackery, a Perl web application framework, writes the login name to its application log without escaping newlines. An unauthenticated attacker can insert fake log lines, such as a forged successful administrator login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running CallBackery for Perl with its login RPC method reachable can have their application logs forged by unauthenticated requests. Deployments where the login endpoint is not exposed to untrusted users are less exposed, and the impact is limited to log integrity rather than code execution or data access.
No product ranges from the sources yet.
cpanm --info CallBackery or the Perl module's dist metadata); versions before 0.62.0 are affected.0.62.0 onward.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.
login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.
An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
This page as .md · .json · in your agent: get_signal("CVE-2026-118994")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.