CVE-2026-95831: Crypt::SelfCertificate Perl Module RCE Vulnerability

CVE-2026-95831 Overview

CVE-2026-95831 identifies a supply chain compromise in the Perl module Crypt::SelfCertificate versions 1.01 through 1.05 distributed via CPAN. The package contains embedded malware that executes attacker-controlled Python code retrieved from a hardcoded, base64-obfuscated HTTP URL. The generate_certificate function invokes a Python script disguised as a certificate file, which fetches and runs a remote payload in memory without writing a script to disk. Any Perl application or developer environment that loads this module and calls the affected function can execute arbitrary code under the calling user's privileges. The malicious artifact is classified under [CWE-506] Embedded Malicious Code.

Critical Impact
Installing and using Crypt::SelfCertificate 1.01–1.05 causes arbitrary Python code retrieved from a remote server to execute as the invoking user, with no file dropped to disk for defenders to inspect.

Affected Products

Crypt::SelfCertificate 1.01 for Perl (CPAN)
Crypt::SelfCertificate 1.02, 1.03, 1.04 for Perl (CPAN)
Crypt::SelfCertificate 1.05 for Perl (CPAN)

Discovery Timeline

2026-09-22 - CVE CVE-2026-95831 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95831

Vulnerability Analysis

The Crypt::SelfCertificate distribution presents itself as a Perl helper for generating self-signed certificates. Instead, the package ships a Python dropper disguised with a certificate file extension. When a caller invokes generate_certificate, the module executes this Python file rather than performing legitimate certificate operations.

The dropper decodes a base64-obfuscated HTTP URL, issues an outbound request, and passes the response body directly to a Python interpreter. Because the second-stage payload is executed from memory, no additional script is written to disk. Defenders relying on file-write telemetry or on-disk scanning of the host will not observe the payload itself, only the network fetch and the interpreter execution.

The releases contain no test scripts and no build hooks, so installation alone does not trigger the payload. Execution occurs only when a Perl process actively calls the affected function, suggesting the operator intended the payload to fire during normal use rather than at install time.

Root Cause

The root cause is trojanized source code published to CPAN under a plausible module name. The package author embedded a malicious Python payload inside lib/Crypt/SelfCertificate/sample/validate.p12 (version 1.01) and lib/Crypt/SelfCertificate/sample/cert7.pem (version 1.05), then wired generate_certificate to execute it. This is a supply chain compromise rather than a coding defect.

Attack Vector

Exploitation requires a user to install Crypt::SelfCertificate from CPAN and to run Perl code that invokes generate_certificate. The dropper then reaches a hardcoded HTTP endpoint and executes whatever the operator returns. Impact scales with the privileges of the calling process, including CI/CD agents, developer workstations, and automated certificate provisioning systems.

The following SHA-256 digests identify the malicious artifacts:

fbff21f45ff748365062a5e36fb2d72558cad82a507a6f357f320b4fcdf07760 — Crypt-SelfCertificate-1.01.tar.gz
27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc — lib/Crypt/SelfCertificate/sample/validate.p12
9fdfa7d69b034b77d4510cda567e8da1e486ca81c7daaadc5732a45c41d71991 — Crypt-SelfCertificate-1.05.tar.gz
27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc — lib/Crypt/SelfCertificate/sample/cert7.pem

No verified proof-of-concept code is required; installation and invocation of the package constitute the exploit path. See the Openwall OSS Security Announcement and Perl CPAN Testers Discussion for the original disclosure details.

Detection Methods for CVE-2026-95831

Indicators of Compromise

Presence of Crypt-SelfCertificate-1.01.tar.gz (SHA-256 fbff21f45ff748365062a5e36fb2d72558cad82a507a6f357f320b4fcdf07760) or Crypt-SelfCertificate-1.05.tar.gz (SHA-256 9fdfa7d69b034b77d4510cda567e8da1e486ca81c7daaadc5732a45c41d71991) in package caches or build artifacts.
Files matching SHA-256 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc at paths lib/Crypt/SelfCertificate/sample/validate.p12 or lib/Crypt/SelfCertificate/sample/cert7.pem.
A perl process spawning python or python3 where the child process reads from stdin or executes inline code rather than a script path.
Outbound HTTP connections initiated by a Python interpreter shortly after a Perl process starts, especially to non-corporate infrastructure.

Detection Strategies

Inventory Perl environments and enumerate installed CPAN modules to flag any host with Crypt::SelfCertificate at versions 1.01 through 1.05.
Alert on process lineages where perl is the parent of python or python3, which is uncommon in most production workloads.
Match file hashes across endpoints, build agents, and artifact stores against the SHA-256 values published in the advisory.

Monitoring Recommendations

Log and review outbound HTTP requests from developer workstations and CI runners to detect connections to the hardcoded dropper URL.
Capture command-line arguments for python invocations and retain them in a searchable telemetry store for retrospective hunts.
Monitor CPAN mirror activity and internal package repositories for the affected tarballs, and quarantine any cached copies.

How to Mitigate CVE-2026-95831

Immediate Actions Required

Uninstall Crypt::SelfCertificate versions 1.01 through 1.05 from all Perl environments, including developer laptops, servers, and CI/CD runners.
Remove cached tarballs matching the published SHA-256 hashes from local CPAN caches, mirrors, and artifact repositories.
Treat any host that executed generate_certificate as potentially compromised and initiate incident response, including credential rotation for the affected user context.
Block the dropper's hardcoded HTTP endpoint at egress once identified from the Openwall OSS Security Update.

Patch Information

No fixed version has been published. Because this is embedded malicious code rather than a coding defect, remediation requires removing the package entirely and selecting an alternative library for self-signed certificate generation, such as invoking openssl directly or using a well-maintained Perl module from a trusted publisher. Refer to the Perl CPAN Testers Discussion for community guidance on replacements.

Workarounds

Add Crypt::SelfCertificate to an internal blocklist enforced by your CPAN proxy or package management policy.
Restrict outbound network access from developer and build environments to a permitted allowlist of package registries and update servers.
Run Perl automation under least-privilege service accounts so that a triggered payload cannot access sensitive credentials or production systems.
Enable application allowlisting on build agents to prevent unexpected Python interpreter invocations from Perl processes.

bash

# Identify and remove the malicious module from a Perl environment
cpanm --uninstall Crypt::SelfCertificate
find / -type f \( -name 'Crypt-SelfCertificate-1.0*.tar.gz' \
  -o -path '*/Crypt/SelfCertificate/sample/validate.p12' \
  -o -path '*/Crypt/SelfCertificate/sample/cert7.pem' \) -print -delete