CVE-2016-10099: Borg Project Borg

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.

Affected products

• Borg Project Borg: up to and including 1.0.8

Published 2017-01-02. Last modified 2026-06-17.