CVE-2026-11702 describes a weakness in Bytes::Random::Secure::Tiny (<=1.011) where the PRNG internal state is shared across forked processes when the PRNG object is initialized before forking. This results in identical random number streams in each process, violating randomness assumptions and allowing predictable secret generation in multiprocess environments. The vulnerability is categorized under CWE-335, indicating incorrect usage of seeds in PRNGs. No official patch or remediation level has been provided as of the published date.

The vulnerability allows attackers to predict secrets generated by the PRNG in multiprocess applications, potentially compromising confidentiality. Since the PRNG state is duplicated across forked processes, secrets such as cryptographic keys or tokens generated independently in each process may be identical or predictable, undermining security guarantees. The CVSS score of 7.5 (high) reflects the network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid initializing the PRNG object before forking processes or reinitialize the PRNG state after forking to ensure unique random streams per process. Review application design to prevent sharing PRNG state across forks.