CVE-2026-6146

Description

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.

PUBLISHED Reserved 2026-04-12 | Published 2026-05-11 | Updated 2026-05-11 | Assigner CPANSec

Problem types

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Product status

References

metacpan.org/...tials-1.2.0/source/lib/Amazon/Credentials.pm

metacpan.org/...ase/BIGFOOT/Amazon-Credentials-1.3.0/changes release-notes

cve.org (CVE-2026-6146)

nvd.nist.gov (CVE-2026-6146)

Download JSON