CVE-2026-4851 is a critical flaw (CVSS 9.8) in the Perl module GRID::Machine, versions through 0.127. The client deserializes replies from the remote host with eval, so a compromised or malicious remote can run arbitrary code on the client. The disclosure lists no fixed version, so limit use to trusted hosts.
What's affected
GRID::Machine for Perl, version 0.127 verified and, per the disclosure, likely all released versions. The disclosure and the record name no fixed version, so check the module's CPAN page for a newer release.
The module provides remote procedure calls over SSH. The flaw is on the client side: code runs on the machine that connects, triggered by the host it connects to.
How to check if you're exposed
Find Perl programs that use the module and which hosts they connect to.
perl -MGRID::Machine -e 'print $GRID::Machine::VERSION, "\n"'
cpan -D GRID::Machine
grep -rl 'GRID::Machine' /path/to/code
Then list every remote host those programs reach. The risk depends on how far you trust each of them.
What to do now
- Find scripts and cron jobs that use GRID::Machine.
- Stop connecting to hosts you do not fully control, until a fix exists.
- Run the clients under accounts with minimal rights, and avoid running them as root or with deployment keys in reach.
- Watch the CPAN page and the project for a release that replaces the eval based reading, and plan a move to another RPC method if none comes.
Why it matters
The classes are CWE-502, deserialization of untrusted data, and CWE-95, eval injection. The disclosure points to read_operation in lib/GRID/Machine/Message.pm, which turns bytes from the remote side into Perl values by running them through eval. Anything that can write to that stream can include code, and the client runs it with its own rights.
The disclosure adds that the design is intentional but the need to trust the remote host is not documented. The CVSS vector says no privileges are required, so read the score in context: the attacker must be, or control, the host the client connects to. That still matters for automation that touches many servers, where one compromised host could reach back to a management machine. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether GRID::Machine is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Quick check
Does this affect the servers I connect to?
The described impact is on the client that connects. A compromised server can run code back on that client.
Sources
Last reviewed: 19 October 2026.
