CVE-2026-74759— Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

Quick assessment

Affected

CVE-2026-74759

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言的 Google::Auth 库 0.12 版本存在服务端请求伪造（SSRF）漏洞，原因是其 AWS 外部账户凭证中未对的 URL 进行验证。当外部账户配置指定使用 AWS 主体令牌类型时，会选用类。其方法在向中定义的、和字段发起请求时，未执行其他凭证类所采用的主机检查（host check）。任何基于自身无法完全控制的配置来构建凭证的调用者，都可能向该配置中指定的主机（包括内部服务和链路本地元数据端点）发起 GET 和 PUT 请求，从而造成安全风险。

AI Predicted 8.1 Difficulty: Moderate Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`0.12`	affected

Updated Nov 02, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

Source: CVE Program / CVE List V5

Vulnerability Description

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0.12	-

II. Public POCs for CVE-2026-74759

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-74759

请登录查看更多情报信息。

Other References for CVE-2026-74759 (1)

https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm technical-description

https://www.cve.org/CVERecord?id=CVE-2026-74759

IV. Related Vulnerabilities

Same weakness: CWE-918