Live › vulnerability › CVE-2026-119037
Business::GoCardless before 1.01 for Perl verifies webhook signatures with each configured secret as the HMAC key, and it does not reject an undef or empty secret. An attacker who can reach the webhook endpoint can sign a forged webhook with an empty key and have it accepted as genuine GoCardless traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams that use Business::GoCardless in a Perl application to receive GoCardless webhooks are exposed when the webhook secret is undef or empty, for example when it comes from an unset environment variable or an empty entry in a rotated secret list. Applications that do not receive GoCardless webhooks through this module, or that always configure a non-empty secret, are not affected by this path.
No product ranges from the sources yet.
perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION' and see whether it is below 1.01.1.01 or later (the advisory states versions before 1.01 are affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.
signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.
A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
This page as .md · .json · in your agent: get_signal("CVE-2026-119037")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.