What’s Vulnerable › Vulnerabilities

CVE-2021-38599

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-12 · updated 2026-06-17
• Weakness: CWE-754

Description

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

Affected products

• Wal-G Project Wal-G: before 1.1 — fixed in 1.1

How to fix

Upgrade to a fixed version: Wal-G Project Wal-G 1.1. Check the vendor advisory for mitigations.

References

• https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3
• https://github.com/wal-g/wal-g/pull/1062
• https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3
• https://github.com/wal-g/wal-g/pull/1062

Get alerted when CVE-2021-38599 or the next vulnerability affects your stack