Predictable Key Generation in Amazon Credentials for Perl

CVE-2026-6146

What is CVE-2026-6146?

Amazon::Credentials for Perl prior to version 1.3.0 utilizes a predictable method for generating encryption keys, relying on the built-in rand function. This approach compromises the cryptographic integrity of the stored credentials, as a 64-bit key derived from a non-random source may be easily reproduced. As a result, the obfuscation intended to protect sensitive information can be rendered ineffective, exposing credentials to potential extraction from data dumps.

References