Server Side Request Forgery in Google::Auth for Perl
CVE-2026-74759

Currently unrated

Key Information:

Status
Vendor
CVE Published:
1 November 2026

What is CVE-2026-74759?

A vulnerability exists in Google::Auth versions 0.12 for Perl that allows for server side request forgery through unvalidated credential_source URLs. Specifically, when configured with an external_account using AWS subject token types, it bypasses host checks in the credential retrieval process. This weakness enables unauthorized GET and PUT requests to specified hosts, which can include internal services and local endpoints. Applications must ensure proper validation of credential_source URLs to mitigate the risk of malicious exploitation.

References

https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/s...
technical-description

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.