Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by CJCOLLIER
CVE-2026-66902 (GCVE-0-2026-66902)
Vulnerability from nvd – Published: 2026-08-04 20:49 – Updated: 2026-08-04 22:24
VLAI
EPSS
VEX
Title
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call
Summary
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.
Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CJCOLLIER | Google::Auth |
Affected:
0 , < 0.06
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-04T22:24:41.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/04/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Google-Auth",
"product": "Google::Auth",
"programFiles": [
"lib/Google/Auth/ExternalAccountCredentials/Pluggable.pm"
],
"programRoutines": [
{
"name": "Google::Auth::ExternalAccountCredentials::Pluggable::retrieve_subject_token"
}
],
"repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
"vendor": "CJCOLLIER",
"versions": [
{
"lessThan": "0.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.\n\nThe Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable\u0027s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a \"type\": \"external_account\" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.\n\nAny caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:49:43.171Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch"
},
{
"url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.06/diff/CJCOLLIER/Google-Auth-0.05"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Google-Auth 0.06 or later, which throws unless the environment variable GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES is set to 1."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-28T00:00:00.000Z",
"value": "Version 0.06 released with fix, which is not noted in the changelog."
}
],
"title": "Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.06, apply the upstream fix commit, or ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-66902",
"datePublished": "2026-08-04T20:49:43.171Z",
"dateReserved": "2026-07-28T08:28:27.249Z",
"dateUpdated": "2026-08-04T22:24:41.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66901 (GCVE-0-2026-66901)
Vulnerability from nvd – Published: 2026-08-04 20:49 – Updated: 2026-08-04 22:24
VLAI
EPSS
VEX
Title
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
Summary
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.
Any caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.
Version 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials.
Severity
No CVSS data available.
CWE
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CJCOLLIER | Google::Auth |
Affected:
0 , < 0.09
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-04T22:24:40.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/04/34"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Google-Auth",
"product": "Google::Auth",
"programFiles": [
"lib/Google/Auth/ExternalAccountCredentials.pm",
"lib/Google/Auth/ServiceAccountCredentials.pm",
"lib/Google/Auth/UserRefreshCredentials.pm",
"lib/Google/Auth/ImpersonatedServiceAccountCredentials.pm"
],
"programRoutines": [
{
"name": "Google::Auth::ExternalAccountCredentials::retrieve_subject_token"
},
{
"name": "Google::Auth::ExternalAccountCredentials::fetch_access_token"
},
{
"name": "Google::Auth::ServiceAccountCredentials::fetch_access_token"
},
{
"name": "Google::Auth::UserRefreshCredentials::fetch_access_token"
},
{
"name": "Google::Auth::ImpersonatedServiceAccountCredentials::fetch_access_token"
}
],
"repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
"vendor": "CJCOLLIER",
"versions": [
{
"lessThan": "0.09",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.\n\nThe URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.\n\nAny caller that builds credentials from a configuration it does not fully control issues those requests from the application\u0027s network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.\n\nVersion 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:49:27.643Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cd42bdef53afcc4531161e85e91d0d5997e01324.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/9b5157062acc605ca9e6c507b910587f4829ce9e.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cbbb07804e3f8cc7cf9638ecc9c2097d80a9ef50.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.09/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Google-Auth 0.09 or later, which validates each URL host against googleapis.com or a universe domain pinned by the application before the request."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-28T00:00:00.000Z",
"value": "Version 0.06 released with a partial fix."
},
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Version 0.08 released, extending the fix to two further credential classes."
},
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Version 0.09 released with the complete fix."
}
],
"title": "Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.09, ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-66901",
"datePublished": "2026-08-04T20:49:27.643Z",
"dateReserved": "2026-07-28T08:28:27.249Z",
"dateUpdated": "2026-08-04T22:24:40.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66902 (GCVE-0-2026-66902)
Vulnerability from cvelistv5 – Published: 2026-08-04 20:49 – Updated: 2026-08-04 22:24
VLAI
EPSS
VEX
Title
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call
Summary
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.
Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CJCOLLIER | Google::Auth |
Affected:
0 , < 0.06
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-04T22:24:41.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/04/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Google-Auth",
"product": "Google::Auth",
"programFiles": [
"lib/Google/Auth/ExternalAccountCredentials/Pluggable.pm"
],
"programRoutines": [
{
"name": "Google::Auth::ExternalAccountCredentials::Pluggable::retrieve_subject_token"
}
],
"repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
"vendor": "CJCOLLIER",
"versions": [
{
"lessThan": "0.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.\n\nThe Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable\u0027s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a \"type\": \"external_account\" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.\n\nAny caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:49:43.171Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch"
},
{
"url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.06/diff/CJCOLLIER/Google-Auth-0.05"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Google-Auth 0.06 or later, which throws unless the environment variable GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES is set to 1."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-28T00:00:00.000Z",
"value": "Version 0.06 released with fix, which is not noted in the changelog."
}
],
"title": "Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.06, apply the upstream fix commit, or ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-66902",
"datePublished": "2026-08-04T20:49:43.171Z",
"dateReserved": "2026-07-28T08:28:27.249Z",
"dateUpdated": "2026-08-04T22:24:41.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66901 (GCVE-0-2026-66901)
Vulnerability from cvelistv5 – Published: 2026-08-04 20:49 – Updated: 2026-08-04 22:24
VLAI
EPSS
VEX
Title
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
Summary
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.
Any caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.
Version 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials.
Severity
No CVSS data available.
CWE
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CJCOLLIER | Google::Auth |
Affected:
0 , < 0.09
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-04T22:24:40.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/04/34"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Google-Auth",
"product": "Google::Auth",
"programFiles": [
"lib/Google/Auth/ExternalAccountCredentials.pm",
"lib/Google/Auth/ServiceAccountCredentials.pm",
"lib/Google/Auth/UserRefreshCredentials.pm",
"lib/Google/Auth/ImpersonatedServiceAccountCredentials.pm"
],
"programRoutines": [
{
"name": "Google::Auth::ExternalAccountCredentials::retrieve_subject_token"
},
{
"name": "Google::Auth::ExternalAccountCredentials::fetch_access_token"
},
{
"name": "Google::Auth::ServiceAccountCredentials::fetch_access_token"
},
{
"name": "Google::Auth::UserRefreshCredentials::fetch_access_token"
},
{
"name": "Google::Auth::ImpersonatedServiceAccountCredentials::fetch_access_token"
}
],
"repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
"vendor": "CJCOLLIER",
"versions": [
{
"lessThan": "0.09",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.\n\nThe URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.\n\nAny caller that builds credentials from a configuration it does not fully control issues those requests from the application\u0027s network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.\n\nVersion 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:49:27.643Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cd42bdef53afcc4531161e85e91d0d5997e01324.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/9b5157062acc605ca9e6c507b910587f4829ce9e.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cbbb07804e3f8cc7cf9638ecc9c2097d80a9ef50.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.09/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Google-Auth 0.09 or later, which validates each URL host against googleapis.com or a universe domain pinned by the application before the request."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-28T00:00:00.000Z",
"value": "Version 0.06 released with a partial fix."
},
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Version 0.08 released, extending the fix to two further credential classes."
},
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Version 0.09 released with the complete fix."
}
],
"title": "Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.09, ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-66901",
"datePublished": "2026-08-04T20:49:27.643Z",
"dateReserved": "2026-07-28T08:28:27.249Z",
"dateUpdated": "2026-08-04T22:24:40.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}