{"id":"CVE-2026-6146","aliases":["EUVD-2026-29199","GHSA-mx57-4jmx-5cvf"],"status":"published","title":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00174,"percentile":0.07004,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338"],"published":"2026-05-11T19:12:17Z","modified":"2026-10-28T02:30:42Z","products":[{"vendor":"bigfoot","product":"amazon::credentials"}],"references":[{"url":"https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418","tags":["web"]},{"url":"https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/15","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6146","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mx57-4jmx-5cvf"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6146.json","tags":["advisory"]},{"url":"https://github.com/rlauer6/Amazon-Credentials","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-6146","title":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","status":"published","published":"2026-05-11T19:12:17.63Z","modified":"2026-05-13T13:00:09.543Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-29199","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","status":"published","published":"2026-05-11T19:12:17Z","modified":"2026-05-13T13:00:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-mx57-4jmx-5cvf","title":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n...","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","status":"published","published":"2026-05-11T21:31:36Z","modified":"2026-10-26T18:32:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:14:24.666824Z"}],"nvd":[{"id":"CVE-2026-6146","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","status":"published","published":"2026-05-11T20:25:47.597Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-6146","title":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys","description":"Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.","status":"published","published":"2026-05-11T19:12:17.63Z","modified":"2026-10-28T02:30:42.679783506Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:45:12.933503Z"}]}}