CVE-2026-74759 Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...