CVE-2007-5626: make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argumen...

Security readout for executives and security teams

Bacula’s catalog backup helper exposed the MySQL password by putting it on the command line, and in some cases by sending that command line in cleartext email. An attacker with the right local visibility, or access to the relevant network path, could learn the backup database password. Exposure is most likely on legacy Bacula deployments that use MySQL-backed catalog backups and the vulnerable make_catalog_backup workflow. Risk depends on who can view process metadata, receive backup emails, or observe unprotected mail/network traffic. Prioritize if Bacula protects business-critical backups or uses shared database credentials. This is mainly a legacy hardening and credential-rotation issue, but exposed backup catalog credentials can undermine recovery integrity and confidentiality. Mitigation focus: Check current Bacula vendor or distribution guidance for the corrected backup script behavior.; Avoid passing database passwords through command-line arguments in backup automation.; Disable cleartext transmission of backup commands or credentials by email..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.