CVE-2026-74759

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

CVE-2026-74760

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760 Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

EUVD-2026-114874

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760

The Google::Auth Perl library (versions 0.11 through 0.12 ) is vulnerable to a local security issue because the gcloud-auth login callback fails to validate the OAuth state parameter. During gcloud-auth login or application-default login commands, the CLI sends a state parameter but fails to comp...

CVE-2026-74759

The Google::Auth Perl library (version 0.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Google::Auth::ExternalAccountCredentials::Aws class. The flaw exists because the retrieve_subject_token method sends requests to the imdsv2_session_token_url, url, and region_url f...

CVE-2026-74759 Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

EUVD-2026-114873

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

CVE-2026-74760: Origin Validation Error

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74759: Server-Side Request Forgery (SSRF)

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

PT-2026-134918

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential source URLs in AWS external account credentials. An external account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve subject token sen...

PT-2026-134919

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-66902

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as "system$command", a single argument call that passes the whol...

CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

CVE-2026-66901

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

EUVD-2026-52920

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

CVE-2026-66901

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

PT-2026-67855

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.06 Description An issue exists where the software executes a command specified in an external account credentials JSON file through an ungated system call. The Pluggable subclass retrieves the credential...

CVE-2026-66901: Server-Side Request Forgery (SSRF)

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

PT-2026-67854

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.09 Description Google::Auth for Perl allows server side request forgery SSRF and credential exfiltration due to unvalidated URLs read from the credentials JSON. The library fails to check hosts against the...