CVE-2026-74759

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...