CVE-2026-74759 - Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS exte
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.
An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.
Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.
INFORMATIONAL
Severity & confidence
Source severityinformational
Platform severityinformational
Confidencehigh
Exploitationunknown
CVSS-
Affected
Vendorsgoogleaws
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-11-01T17:16:34
Last updated2026-11-04T16:59:27
Ingested2026-11-02T15:24:53
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
