CVE-2026-6146

MEDIUM5.3

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys

Published May 11, 2026

Modified 3 weeks ago

Details

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.

Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.

Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.

References

WEB

http://www.openwall.com/lists/oss-security/2026/05/11/15

WEB

https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418

WEB

https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-6146

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

Other

CWE-338

Ecosystems

Timeline

PublishedMay 11, 2026

ModifiedMay 13, 2026

CVE-2026-6146 | Mondoo Vulnerability Intelligence