CVE-2026-6146 Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys
An attacker can predict encryption keys to decrypt stored credentials in the Amazon::Credentials Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6146?
CVE-2026-6146 is a medium-severity vulnerability in BIGFOOT Amazon::Credentials, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.
Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.
Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
Weakness: CWE-338
Which versions are affected by CVE-2026-6146?
How do I fix CVE-2026-6146?
No fix has been published for CVE-2026-6146 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6146 being exploited?
There is no known exploitation of CVE-2026-6146 in the wild and no public exploit code.
Sources
Also known as GHSA-mx57-4jmx-5cvf.