CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

• CWE-754

• https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3Patch, Third Party Advisory
• https://github.com/wal-g/wal-g/pull/1062Patch, Third Party Advisory
• https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3Patch, Third Party Advisory
• https://github.com/wal-g/wal-g/pull/1062Patch, Third Party Advisory

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38590In cPanel before 96.0.8, weak permissions on web stats can l…5.5
• CVE-2021-38591An issue was discovered on LG mobile devices with Android OS…3.3
• CVE-2021-38592Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (…7.5
• CVE-2021-38593Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bou…7.5
• CVE-2021-38597wolfSSL before 4.8.1 incorrectly skips OCSP verification in …5.9
• CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.…9.1
• CVE-2021-3860JFrog Artifactory before 7.25.4 (Enterprise+ deployments onl…8.8
• CVE-2021-38602PluXML 5.8.7 allows Article Editing stored XSS via Headline …4.8
• CVE-2021-38603PluXML 5.8.7 allows core/admin/profil.php stored XSS via the…4.8
• CVE-2021-38604In librt in the GNU C Library (aka glibc) through 2.34, sysd…7.5
• CVE-2021-38606reNgine through 0.5 relies on a predictable directory name.9.8
• CVE-2021-38607Crocoblock JetEngine before 2.6.1 allows XSS by remote authe…5.4