Junglewise Threat Intelligence

CVE-2026-6146: Amazon::Credentials weak PRNG in encryption key generation

CVE-2026-6146 · Severity: medium · CVSS 5.3 · Published 2026-05-11

Vendors: Perl CPAN.

Executive brief

Amazon::Credentials is a Perl module used to manage and provide AWS credentials. In versions up to 1.2.0, the library uses a weak and predictable method to generate the encryption keys used to protect sensitive credentials in memory. This could allow an attacker with access to a system's memory or data dumps to easily guess the keys and expose the underlying AWS secrets, potentially leading to unauthorized access to cloud resources.

Technical details

Amazon::Credentials (versions <= 1.2.0) utilizes the built-in Perl 'rand' function to generate 64-bit encryption keys used for obfuscating AWS secrets within object data dumps. Because 'rand' is a non-cryptographic PRNG, the resulting keys are predictable. An attacker who obtains a data dump of the object or has local access to the execution environment could potentially brute-force or predict the key to decrypt sensitive AWS access keys and session tokens. The vulnerability was addressed in version 1.3.0 by removing the flawed encryption/obfuscation feature in favor of a more secure implementation.

Affected products

  • Perl CPAN Amazon::Credentials through 1.2.0

Timeline

  • 2026-05-11: disclosed
  • 2026-05-11: advisory
  • 2026-05-05: patched: Version 1.3.0 released

References