CVE-2026-6146: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in BIGFOOT Amazon::Credentials
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
AI Analysis
Technical Summary
Amazon::Credentials versions up to 1.2.0 use the Perl built-in rand function to generate 64-bit encryption keys for obfuscating stored credentials. Since rand is a predictable and cryptographically weak PRNG, the encryption keys can potentially be guessed or reproduced, undermining the confidentiality of the secrets. This vulnerability is classified under CWE-338 (Use of Cryptographically Weak PRNG). There is no vendor advisory or patch available at this time, and the module is not a cloud service.
Potential Impact
The vulnerability allows an attacker to potentially predict or reproduce the encryption keys used to protect stored credentials, leading to partial compromise of confidentiality. There is no impact on integrity or availability reported. The CVSS score is 5.3 (medium), reflecting the network attack vector, low complexity, no privileges required, and limited confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using versions of Amazon::Credentials prior to 1.3.0 or implement additional encryption mechanisms using a cryptographically secure PRNG. No vendor advisory or official fix has been published yet.
CVE-2026-6146: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in BIGFOOT Amazon::Credentials
Description
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Amazon::Credentials versions up to 1.2.0 use the Perl built-in rand function to generate 64-bit encryption keys for obfuscating stored credentials. Since rand is a predictable and cryptographically weak PRNG, the encryption keys can potentially be guessed or reproduced, undermining the confidentiality of the secrets. This vulnerability is classified under CWE-338 (Use of Cryptographically Weak PRNG). There is no vendor advisory or patch available at this time, and the module is not a cloud service.
Potential Impact
The vulnerability allows an attacker to potentially predict or reproduce the encryption keys used to protect stored credentials, leading to partial compromise of confidentiality. There is no impact on integrity or availability reported. The CVSS score is 5.3 (medium), reflecting the network attack vector, low complexity, no privileges required, and limited confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using versions of Amazon::Credentials prior to 1.3.0 or implement additional encryption mechanisms using a cryptographically secure PRNG. No vendor advisory or official fix has been published yet.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-04-12T17:24:50.568Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a022c38cbff5d86104f7ce4
Added to database: 05/11/2026, 19:21:28 UTC
Last enriched: 05/19/2026, 09:40:53 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.