Live › vulnerability › CVE-2026-74759
Google::Auth for Perl version 0.12 sends requests to URLs taken from an external_account AWS credential configuration without checking the host. An attacker who controls that configuration can make the server call internal services or cloud metadata endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 17:21 UTC. All times on this page are UTC.
Applications that build Google::Auth credentials from an external_account configuration the application does not fully control, using the AWS subject token type. Applications that only use their own fixed credential files, or that never load external_account configs, are not exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
0.12 (for example with perl -MGoogle::Auth -e 'print $Google::Auth::VERSION').external_account configurations loaded from user input or other untrusted sources.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.
An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.
Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-74759")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.