CVE-2026-6659: Crypt::PasswdMD5 Insecure Salt Vulnerability

CVE-2026-6659 Overview

CVE-2026-6659 affects Crypt::PasswdMD5 versions through 1.42 for Perl. The module generates salts using Perl's built-in rand function, which is predictable and unsuitable for cryptographic use. This weakness falls under CWE-338, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). Attackers who can predict salt values can precompute hashes or accelerate password cracking against stored credentials. The flaw impacts confidentiality of hashed passwords protected by this library.

Critical Impact

Predictable salts reduce the cost of offline password cracking and undermine the protection that salted MD5 hashing is intended to provide.

Affected Products

• Crypt::PasswdMD5 Perl module versions through 1.42
• Applications using unix_md5_crypt or apache_md5_crypt from this module
• Perl-based authentication systems relying on this library for salt generation

Discovery Timeline

• 2026-05-08 - CVE-2026-6659 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6659

Vulnerability Analysis

Crypt::PasswdMD5 implements the MD5-based crypt schemes used by Unix systems and Apache htpasswd. The module generates an eight-character salt before computing the hash. In versions through 1.42, the salt characters are selected using Perl's rand function, which is a non-cryptographic PRNG seeded from limited entropy sources.

The rand function in Perl is deterministic and seedable. An attacker who learns or guesses the seed can reproduce the exact salt sequence generated by a target process. Even without seed recovery, the limited entropy space of rand enables statistical attacks against salts produced in bulk.

Salts exist to defeat precomputed rainbow tables and to force per-password cracking work. When salts become predictable, attackers can precompute hashes for likely passwords against anticipated salts. This collapses the security model that MD5-crypt depends on, particularly when the underlying MD5 algorithm is already considered weak.

Root Cause

The root cause is the use of Perl's built-in rand for security-sensitive randomness. The module's salt generation loop calls rand to index into the base64 alphabet rather than reading from /dev/urandom, Crypt::URandom, or Bytes::Random::Secure. See the MetaCPAN source for Crypt::PasswdMD5 for the affected code path.

Attack Vector

Exploitation does not require network access to the target system. An attacker who obtains a password hash database, through a separate disclosure or breach, can apply offline analysis. Knowledge of the salt generation algorithm and access to the process state, timing, or co-located output, increases the predictability of subsequent salts. The vulnerability mechanism is documented in the Openwall oss-security discussion.

Detection Methods for CVE-2026-6659

Indicators of Compromise

• Presence of Crypt::PasswdMD5 versions at or below 1.42 in installed Perl modules
• Application code importing unix_md5_crypt or apache_md5_crypt without supplying an externally generated salt
• Stored password hashes with the $1$ or $apr1$ prefix produced by affected versions

Detection Strategies

• Audit Perl dependency manifests, cpanfile, and Makefile.PL for Crypt::PasswdMD5 version constraints
• Run cpan -D Crypt::PasswdMD5 or corelist checks across build pipelines and production hosts
• Scan source repositories for calls to the module where the salt argument is omitted, triggering internal generation

Monitoring Recommendations

• Track package inventories for Perl libraries through software composition analysis tools
• Alert on builds that pin vulnerable versions of Crypt::PasswdMD5 in CI/CD systems
• Review authentication subsystems that rely on htpasswd files generated by Perl tooling

How to Mitigate CVE-2026-6659

Immediate Actions Required

• Identify all systems and applications using Crypt::PasswdMD5 versions through 1.42
• Replace internal salt generation by passing a cryptographically secure salt to unix_md5_crypt and apache_md5_crypt
• Migrate stored credentials to a modern password hashing function such as bcrypt, scrypt, or Argon2

Patch Information

No fixed version was listed in the NVD record at the time of publication. Monitor MetaCPAN for updates from the module maintainer, and consult the Openwall advisory thread for remediation guidance.

Workarounds

• Generate salts externally using Crypt::URandom or Bytes::Random::Secure and pass them explicitly to the hashing function
• Replace Crypt::PasswdMD5 with Crypt::Passphrase or another maintained library that uses cryptographic PRNGs by default
• Rotate passwords hashed by affected versions after implementing secure salt generation

# Configuration example: generate a secure salt in Perl before hashing
perl -MCrypt::URandom=urandom -MMIME::Base64 -e '
  my $salt = substr(encode_base64(urandom(6), ""), 0, 8);
  print "$salt\n";
'