{"id":"CVE-2026-74759","title":"Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials","summary":"Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.\n\nAn external_account configuration with the AWS subject token type selects Google::Auth::Ex…","severity":"none","cwe":["CWE-918"],"product":"Google-Auth","affected":["Google-Auth 0.12"],"published":"2026-11-01","updated":"2026-11-01","sourceUpdated":"2026-11-01T16:43:14.737Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74759","references":[{"url":"https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm"}],"tags":["cve.org"],"epss":0.00177,"epssPercentile":0.0729,"ingestedAt":"2026-11-05T18:28:50.723Z","slug":"CVE-2026-74759","body":"## Overview\n\nGoogle::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.\n\nAn external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.\n\nAny caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.\n\n## Affected\n\n- `Google-Auth 0.12`\n\n## Remediation\n\nUpgrade to a future Google-Auth release.\n\n### Workarounds\n\nEnsure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}