CVE-2026-74759

The Google::Auth Perl library (version 0.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Google::Auth::ExternalAccountCredentials::Aws class. The flaw exists because the retrieve_subject_token method sends requests to the imdsv2_session_token_url, url, and region_url f...

EUVD-2026-114873

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...