CVE-2026-6146 Details
Description
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
A vulnerability exists in the Amazon::Credentials Perl module, affecting versions through 1.2.0. The issue arises because the module uses the rand function to generate encryption keys, leading to predictable and insecure key generation. This vulnerability allows for the potential decryption of obfuscated AWS credentials, which are stored to prevent exposure in the event of a data dump. Prior to version 1.3.0, the module encrypted secrets with a 64-bit key derived from the rand function, creating a risk of key prediction and unauthorized decryption.
Users can upgrade to Amazon::Credentials version 1.3.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418 | CPANSec | Source CodeVendor |
| https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/11/15 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Amazon::Credentials | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CVE |
| May 11, 2026 | New CVE Received | CPANSec |