CVE-2026-19546: Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
Other sources
Incomplete fix for CVE-2026-14380 in rhel 9.8.z and 10.2.z.
Details of CVE-2026-14380:
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBIPROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DBI (Perl)to a version that resolves this vulnerability.Fixed in 1.650 - Configuration
Ensure DBI_PROFILE is not set (or is set only to trusted, non-user-controlled values) because DBI_Profile can carry untrusted data that reaches the Profile attribute and enables arbitrary Perl code execution.
DBI DBI_PROFILE environment variable = Unset/avoid setting to untrusted data - Configuration
Do not set/assign the DBI handle's Profile attribute from caller-influenced or untrusted input. Any string assigned to Profile is split into path/package/arguments and interpolates the package part in a string eval without validation.
DBI DBI handle Profile attribute = Do not assign caller-influenced strings - Compensating control
If using a network-exposed DBI::Gofer/DBI::ProxyServer, restrict access so that client-controlled DSNs that reach the Profile attribute cannot be supplied by untrusted remote callers (e.g., allow-list only trusted hosts/users at the network layer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19546?
CVE-2026-19546 has a high severity score of 8.8.
What type of vulnerability is CVE-2026-19546?
CVE-2026-19546 is classified as a code injection vulnerability.
How does CVE-2026-19546 affect DBI software?
CVE-2026-19546 allows for arbitrary code execution due to an incomplete fix for a previous vulnerability.
Which versions of DBI are affected by CVE-2026-19546?
CVE-2026-19546 affects RHEL 9.8.z and 10.2.z versions of DBI.
How can I mitigate CVE-2026-19546?
Consult the advisory from Red Hat for detailed mitigation steps for CVE-2026-19546.