CVE-2026-118994: CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.

login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.

An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery to a version that resolves this vulnerability.
Fixed in 0.62.0

Event History

Oct 30, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker able to invoke the login RPC method can exploit it. No valid account or prior authentication is required.

What attacker-controlled input is needed?

The attacker must supply a login name containing a newline followed by text crafted to resemble the application's log-record format. This can insert forged entries into the application log.

Are deployments running version 0.62.0 affected?

The issue affects CallBackery versions before 0.62.0. Version 0.62.0 is not identified as affected by the provided information.

How can I determine whether logs may have been manipulated?

Review application log entries for unexpected successful administrator logins or other records that contain suspicious login-name content, especially entries that appear to originate from unexpected addresses. Because forged text can be made to resemble normal log records, corroborate suspicious entries with independent authentication or network records.

CVE-2026-118994: CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What attacker-controlled input is needed?

Are deployments running version 0.62.0 affected?

How can I determine whether logs may have been manipulated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What attacker-controlled input is needed?

Are deployments running version 0.62.0 affected?

How can I determine whether logs may have been manipulated?