CVE-2026-74759

{"id": "CVE-2026-74759", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl", "modules": ["Google::Auth"], "versions": [{"status": "affected", "version": "0.12", "versionType": "custom"}], "packageURL": "pkg:cpan/Google-Auth", "packageName": "Google-Auth", "programFiles": ["lib/Google/Auth/ExternalAccountCredentials/Aws.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Google::Auth::ExternalAccountCredentials::Aws::retrieve_subject_token"}]}]}], "published": "2026-11-01T17:16:34.280", "references": [{"url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.\n\nAn external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.\n\nAny caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints."}], "lastModified": "2026-11-02T19:34:23.993", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}