---
id: "CVE-2026-118994"
kind: "vulnerability"
aliases: ["CVE-2026-118994"]
title: "CallBackery for Perl: forged log entries via newlines in login name"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["callbackery", "package", "perl", "self-hosted"]
not_affected_if: ["login-not-exposed", "version-0.62.0-or-later"]
published_at: "2026-10-30T13:18:32+00:00"
first_seen_at: "2026-10-30T13:30:27+00:00"
updated_at: "2026-10-30T13:32:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118994", "first_seen_at": "2026-10-30T13:30:27+00:00"}]
---

# CallBackery for Perl: forged log entries via newlines in login name

CallBackery, a Perl web application framework, writes the login name to its application log without escaping newlines. An unauthenticated attacker can insert fake log lines, such as a forged successful administrator login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CallBackery version (for example with `cpanm --info CallBackery` or the Perl module's dist metadata); versions before `0.62.0` are affected.
- Review whether the login RPC method is reachable from the internet in your deployment.

## Fix

- CallBackery versions from `0.62.0` onward.

## Timeline

- 2026-10-30T13:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118994

## From the sources

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.

login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.

An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_