CVE-2026-6146

{
  "id": "CVE-2026-6146",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-05-11T20:25:47.597",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.\n\nAmazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.\n\nBefore version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography."
    },
    {
      "lang": "es",
      "value": "Las versiones de Amazon::Credentials hasta la 1.2.0 para Perl utilizan rand para generar claves de cifrado.\n\nAmazon::Credentials almacena las credenciales de forma ofuscada para evitar el acceso a los secretos desde un volcado de datos del objeto.\n\nAntes de la versión 1.3.0, los secretos se cifraban utilizando una clave de 64 bits que se generaba con la función rand incorporada, la cual es predecible e inadecuada para la criptografía."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "BIGFOOT",
          "product": "Amazon::Credentials",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Amazon-Credentials",
          "programFiles": [
            "lib/Amazon/Credentials.pm"
          ],
          "programRoutines": [
            {
              "name": "Amazon::Credentials::create_passkey"
            }
          ],
          "repo": "https://github.com/rlauer6/Amazon-Credentials",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.2.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T12:59:35.540086Z",
          "id": "CVE-2026-6146",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/11/15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}