CVE-2026-66901

{
  "id": "CVE-2026-66901",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-08-04T21:16:37.127",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.\n\nThe URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.\n\nAny caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.\n\nVersion 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials."
    },
    {
      "lang": "es",
      "value": "Las versiones de Google::Auth anteriores a la 0.09 para Perl permiten la falsificación de solicitudes del lado del servidor y la exfiltración de credenciales a través de URLs no validadas tomadas del JSON de credenciales.\n\nLas URLs que la biblioteca solicita se leen del JSON de credenciales, y sus hosts no se verificaban contra el dominio del universo antes de la solicitud. Para una configuración de external_account, retrieve_subject_token obtenía credential_source.url con encabezados del mismo JSON, y fetch_access_token publicaba el token de sujeto en token_url, luego enviaba el token de acceso STS que recibía a service_account_impersonation_url en un encabezado Authorization: Bearer. Las configuraciones de authorized_user, impersonated_service_account y service_account publicaban el secreto del cliente y el token de actualización, el token de acceso de origen, y una aserción JWT firmada a su propia token_uri o URL de suplantación suministrada por JSON.\n\nCualquier llamador que construye credenciales a partir de una configuración que no controla completamente emite esas solicitudes desde la posición de red de la aplicación, alcanzando hosts que la configuración nombra, incluyendo servicios internos y puntos finales de metadatos link-local, y les entrega las credenciales que cada solicitud lleva. La aserción de service_account está vinculada a aud, por lo que no es reproducible contra Google.\n\nLa versión 0.06 añadió una verificación de host _validate_url a la clase external_account, basada en un universe_domain leído del mismo JSON de credenciales. La versión 0.07 restringió un dominio de universo suministrado por JSON detrás de GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, derivando el indicador de pin de argumentos que un pase BUILDARGS anterior ya había fusionado en la ruta make_creds. La versión 0.08 pasó la decisión del pin como un argumento explícito del constructor y movió _validate_url a Google::Auth::Credentials, añadiendo la llamada a UserRefreshCredentials e ImpersonatedServiceAccountCredentials, y la 0.09 la añadió a ServiceAccountCredentials."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "CJCOLLIER",
          "product": "Google::Auth",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Google-Auth",
          "programFiles": [
            "lib/Google/Auth/ExternalAccountCredentials.pm",
            "lib/Google/Auth/ServiceAccountCredentials.pm",
            "lib/Google/Auth/UserRefreshCredentials.pm",
            "lib/Google/Auth/ImpersonatedServiceAccountCredentials.pm"
          ],
          "programRoutines": [
            {
              "name": "Google::Auth::ExternalAccountCredentials::retrieve_subject_token"
            },
            {
              "name": "Google::Auth::ExternalAccountCredentials::fetch_access_token"
            },
            {
              "name": "Google::Auth::ServiceAccountCredentials::fetch_access_token"
            },
            {
              "name": "Google::Auth::UserRefreshCredentials::fetch_access_token"
            },
            {
              "name": "Google::Auth::ImpersonatedServiceAccountCredentials::fetch_access_token"
            }
          ],
          "repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.09",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T19:26:34.144392Z",
          "id": "CVE-2026-66901",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/9b5157062acc605ca9e6c507b910587f4829ce9e.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cbbb07804e3f8cc7cf9638ecc9c2097d80a9ef50.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/cd42bdef53afcc4531161e85e91d0d5997e01324.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.09/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/08/04/34",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}