---
id: "CVE-2026-119037"
kind: "vulnerability"
aliases: ["CVE-2026-119037"]
title: "Business::GoCardless Perl module accepts forged webhooks with an empty secret"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gocardless", "package", "perl", "webhooks"]
not_affected_if: ["no-webhooks", "non-empty-secret"]
published_at: "2026-10-30T13:18:32+00:00"
first_seen_at: "2026-10-30T13:30:27+00:00"
updated_at: "2026-10-30T13:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119037", "first_seen_at": "2026-10-30T13:30:27+00:00"}]
---

# Business::GoCardless Perl module accepts forged webhooks with an empty secret

Business::GoCardless before 1.01 for Perl verifies webhook signatures with each configured secret as the HMAC key, and it does not reject an undef or empty secret. An attacker who can reach the webhook endpoint can sign a forged webhook with an empty key and have it accepted as genuine GoCardless traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Business::GoCardless with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'` and see whether it is below `1.01`.
- Look for webhook secrets loaded from environment variables or from lists of rotated secrets that could be unset or empty.

## Fix

- Business::GoCardless: move to `1.01` or later (the advisory states versions before 1.01 are affected).

## Timeline

- 2026-10-30T13:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119037

## From the sources

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.

signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.

A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_