{"id":"CVE-2026-118994","kind":"vulnerability","aliases":["CVE-2026-118994"],"related":[],"title":"CallBackery for Perl: forged log entries via newlines in login name","description":"CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.\n\nlogin() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.\n\nAn unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.","summary":"CallBackery, a Perl web application framework, writes the login name to its application log without escaping newlines. An unauthenticated attacker can insert fake log lines, such as a forged successful administrator login.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["login-not-exposed","version-0.62.0-or-later"],"how_to_check":"- Check the installed CallBackery version (for example with `cpanm --info CallBackery` or the Perl module's dist metadata); versions before `0.62.0` are affected.\n- Review whether the login RPC method is reachable from the internet in your deployment.","fix":"- CallBackery versions from `0.62.0` onward.","status":"open","published_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:24+00:00","updated_at":"2026-10-30T13:32:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:24Z","model":"claude-haiku-5-5","output":{"fix":"- CallBackery versions from `0.62.0` onward.","reach":"internet","title":"CallBackery for Perl: forged log entries via newlines in login name","impact":"low","summary":"CallBackery, a Perl web application framework, writes the login name to its application log without escaping newlines. An unauthenticated attacker can insert fake log lines, such as a forged successful administrator login.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Forged administrator login records appear in the application log","analyst_note":"","how_to_check":"- Check the installed CallBackery version (for example with `cpanm --info CallBackery` or the Perl module's dist metadata); versions before `0.62.0` are affected.\n- Review whether the login RPC method is reachable from the internet in your deployment.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.62.0-or-later","login-not-exposed"],"who_is_affected":"Teams running CallBackery for Perl with its login RPC method reachable can have their application logs forged by unauthenticated requests. Deployments where the login endpoint is not exposed to untrusted users are less exposed, and the impact is limited to log integrity rather than code execution or data access.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":4137,"output_tokens":504,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118994':14A,17A '-2026':13A,16A '0.62.0':59C 'add':105C 'address':124C 'administr':54B,120C 'allow':62C 'applic':28B,36B,78C 'attack':43B,111C 'authent':90C 'callbackeri':1A,18B,24B,56C 'charact':83C 'choos':127C 'contain':94C 'control':82C 'cve':12A,15A 'entri':6A 'escap':39B,81C 'fake':46B 'follow':97C 'forg':4A,52B,107C,113C 'format':104C 'framework':29B 'host':23B 'inject':64C 'insert':45B 'line':48B 'log':5A,37B,47B,63C,79C,102C,114C 'login':10A,32B,55B,69C,71C,74C,85C,121C 'method':87C 'name':11A,33B,70C,75C,93C 'need':88C 'newlin':8A,40B,66C,96C 'packag':19B 'perl':3A,20B,26B,61C 'record':103C,108C,115C 'rpc':86C 'self':22B 'self-host':21B 'success':53B,119C 'text':99C 'unauthent':42B,110C 'version':57C 'via':7A,65C 'web':27B 'without':38B,80C 'write':30B,72C","nicknames":[],"mitigations":[],"who_affected":"Teams running CallBackery for Perl with its login RPC method reachable can have their application logs forged by unauthenticated requests. Deployments where the login endpoint is not exposed to untrusted users are less exposed, and the impact is limited to log integrity rather than code execution or data access.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118994","severity":null,"published_at":"2026-10-30T13:18:32+00:00","modified_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}