CVE-2026-74759: SSRF
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials.
An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends requests to the imdsv2sessiontokenurl, url and regionurl fields of credentialsource without the host check that the other credential classes apply.
Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Google::Auth 0.12 for Perl are exposed when they construct AWS external account credentials from an external_account configuration that is not fully trusted.
What control does an attacker need to exploit it?
An attacker needs to influence the credential_source values in an external_account configuration using the AWS subject token type. The relevant fields are imdsv2_session_token_url, url, and region_url.
What network activity can exploitation cause?
Credential retrieval can issue PUT and GET requests to hosts named in the attacker-influenced credential_source fields. This can include internal services and link-local metadata endpoints.