CVE-2026-74759
Received Received - Intake

Server-Side Request Forgery in Google::Auth Perl Library

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: CPANSec

Description
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-74759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google auth 0.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Google::Auth versions 0.12 for Perl allows server side request forgery due to unvalidated credential_source URLs in AWS external account credentials. The issue occurs when an external_account configuration with AWS subject token type sends requests to URLs specified in credential_source without proper host validation, potentially allowing access to internal services or metadata endpoints.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected GET or PUT requests to internal services or metadata endpoints originating from Perl applications using Google::Auth 0.12. Check logs for requests to AWS IMDSv2 endpoints or other credential_source URLs not validated by the application.

Impact Analysis

This vulnerability could allow attackers to make unauthorized requests to internal services or metadata endpoints by exploiting unvalidated URLs. If your application uses Google::Auth 0.12 for Perl with AWS external account credentials, an attacker might gain access to sensitive internal resources or metadata, leading to potential data breaches or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately upgrade Google::Auth to a patched version if available. Review and restrict external_account configurations to trusted sources only. Disable unnecessary AWS credential_source URLs in configurations. Monitor network traffic for suspicious requests to internal endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...