CVE-2026-74759

{
  "id": "CVE-2026-74759",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-11-01T17:16:34.280",
  "lastModified": "2026-11-01T17:16:34.280",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.\n\nAn external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.\n\nAny caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Google-Auth",
          "modules": [
            "Google::Auth"
          ],
          "programFiles": [
            "lib/Google/Auth/ExternalAccountCredentials/Aws.pm"
          ],
          "programRoutines": [
            {
              "name": "Google::Auth::ExternalAccountCredentials::Aws::retrieve_subject_token"
            }
          ],
          "repo": "https://github.com/GoogleCloudPlatform/google-auth-library-perl",
          "packageURL": "pkg:cpan/Google-Auth",
          "versions": [
            {
              "version": "0.12",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}