← Database

CVE-2021-38599

HIGH CVSS: 7.5 Published: 2021-08-12 Modified: 2026-06-17

Description

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

Affected Platforms

Wal-G Project Wal-G

Weakness Type

CWE-754

References