An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.
Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to a future Google-Auth release.
Vendor Workaround
Ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 01 Nov 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints. | |
| Title | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials | |
| Weaknesses | CWE-918 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-01T16:43:14.737Z
Reserved: 2026-08-15T12:28:17.421Z
Link: CVE-2026-74759
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-01T17:16:34.280
Modified: 2026-11-01T17:16:34.280
Link: CVE-2026-74759
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-01T18:30:09Z
-
CWE-918
Server-Side Request Forgery (SSRF)