CVE-2026-74759
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Google::Auth version 0.12 for Perl allows server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. The Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without the host check applied by other credential classes.
Risk Assessment
A configuration from an untrusted source can force requests to internal services or link-local metadata endpoints, risking data leakage and cloud escalation. The risk affects applications building credentials from configurations they do not fully control.
Recommendation
Upgrade Google::Auth to a version that validates the host for credential_source in AWS credentials. Ensure external_account configurations come only from trusted sources.
Other vulnerabilities in Google::Auth
See all- CVE-2026-66902Critical
Google::Auth for Perl before version 0.06 runs a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command and runs it as `system($command)`, passing the whole string to /bin/sh -c. No opt-in gate guards the call, and the path is reached from the standard Application Default Credentials flow.
- CVE-2026-74760Low risk· EPSS 2%
Google::Auth versions 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, and the CLI exchanges it and stores the refresh token as the user's credentials.
- CVE-2026-66901High
Vulnerability in Google::Auth for Perl before version 0.09 allows SSRF and credential exfiltration. URLs taken from the credentials JSON are not validated against the universe domain, enabling requests to internal services and link-local endpoints with application credentials.
Original NVD description (English source)
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS