CVE-2026-118991: falha em CallBackery
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.1%
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.
getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.
An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.
Produtos afetados
CallBackeryCVEs relacionadas — CallBackery
No mesmo produto, das mais perigosas para as menos.
CVE-2026-118995—CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorEPSS 0.3%CVE-2026-118988—CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118994—CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameEPSS 0.2%CVE-2026-118990—CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118986—CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()EPSS 0.2%