CVE-2026-8647: Crypt::ScryptKDF Insecure RNG Vulnerability

CVE-2026-8647 Overview

CVE-2026-8647 affects Crypt::ScryptKDF versions through 0.010 for Perl. The module's random_bytes function falls back to Perl's built-in rand() when no cryptographically secure pseudo-random number generator (CSPRNG) module is available. This fallback produces predictable output unsuitable for cryptographic operations such as salt generation in the scrypt key derivation function. The weakness is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator. Applications relying on Crypt::ScryptKDF for password hashing or key derivation may produce predictable salts when none of the supported CSPRNG modules are installed.

Critical Impact
Predictable salt generation undermines the security guarantees of scrypt-derived keys and password hashes, enabling precomputation and offline attacks against credentials.

Affected Products

Crypt::ScryptKDF for Perl, versions through 0.010
Perl applications using Crypt::ScryptKDF::random_bytes without Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure installed
Downstream software bundling vulnerable releases of the module

Discovery Timeline

2026-05-26 - CVE-2026-8647 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8647

Vulnerability Analysis

Crypt::ScryptKDF implements the scrypt key derivation function in Perl. The module's random_bytes routine attempts to source entropy from one of several CSPRNG modules: Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure. When none of these modules are installed, the function silently falls back to Perl's built-in rand() function.

Perl's rand() is a non-cryptographic pseudo-random number generator. It is seeded from low-entropy sources and produces output that an attacker can predict given partial observation or knowledge of seeding conditions. Using rand() to produce salts or keys for scrypt defeats the purpose of the KDF.

The issue is corrected in version 0.011, which removes the unsafe fallback and instead requires a CSPRNG module to be present.

Root Cause

The root cause is an unsafe default in cryptographic code. The module prioritized availability over correctness by falling back to rand() rather than failing closed when no secure entropy source is present. This pattern violates secure-by-default design principles for cryptographic libraries.

Attack Vector

An attacker who obtains a stored hash or derived key produced under the vulnerable fallback can attempt to predict the salt by reproducing the rand() output. Predictable salts allow precomputed rainbow tables, reduce per-credential attack cost, and enable parallel offline brute-force attacks against multiple hashes. The vulnerability does not require network access or authentication. It manifests during normal application operation on hosts lacking any of the supported CSPRNG modules.

Verified technical details are documented in the MetaCPAN release diff and the Openwall OSS-Security disclosure.

Detection Methods for CVE-2026-8647

Indicators of Compromise

Installations of Crypt-ScryptKDF at version 0.010 or earlier on Perl hosts
Absence of Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, and Bytes::Random::Secure from the local Perl environment
Stored scrypt hashes generated by applications running on systems matching the above conditions

Detection Strategies

Inventory Perl module versions with cpan -l or perldoc -l Crypt::ScryptKDF and flag versions at or below 0.010
Audit application dependencies in cpanfile, Makefile.PL, or dist.ini for unpinned or vulnerable Crypt::ScryptKDF requirements
Review code paths that call Crypt::ScryptKDF::random_bytes and verify a CSPRNG module is explicitly required at runtime

Monitoring Recommendations

Add the module and version to software composition analysis (SCA) policies and vulnerability scanners
Monitor package management logs for installation or upgrade events involving Crypt-ScryptKDF
Track downstream applications that produce password hashes or derived keys and validate the entropy source in use

How to Mitigate CVE-2026-8647

Immediate Actions Required

Upgrade Crypt::ScryptKDF to version 0.011 or later on all Perl hosts
Install at least one supported CSPRNG module such as Crypt::PRNG or Crypt::OpenSSL::Random as an explicit dependency
Rotate password hashes and derived keys that may have been generated on systems lacking a CSPRNG module

Patch Information

The maintainer released Crypt::ScryptKDF version 0.011, which removes the unsafe rand() fallback. Patch details are available in the MetaCPAN release changes and the source diff against version 0.010.

Workarounds

Pin application dependencies to require Crypt::ScryptKDF>= 0.011
Where upgrades are blocked, install Crypt::PRNG or Crypt::OpenSSL::Random system-wide so the vulnerable fallback path is never taken
Replace direct use of Crypt::ScryptKDF::random_bytes with explicit calls to a vetted CSPRNG in application code

bash

# Upgrade and ensure a CSPRNG module is present
cpanm Crypt::ScryptKDF@0.011
cpanm Crypt::PRNG
perl -MCrypt::ScryptKDF -e 'print $Crypt::ScryptKDF::VERSION, "\n"'