========================================================================
CVE-2026-74759                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-74759

   Distribution:  Google-Auth
       Versions:  0.12
       MetaCPAN:  https://metacpan.org/dist/Google-Auth
       VCS Repo:
https://github.com/GoogleCloudPlatform/google-auth-library-perl

Google::Auth versions 0.12 for Perl allow server side request forgery
via unvalidated credential_source URLs in AWS external account
credentials

Description
-----------
Google::Auth versions 0.12 for Perl allow server side request forgery
via unvalidated credential_source URLs in AWS external account
credentials.

An external_account configuration with the AWS subject token type
selects Google::Auth::ExternalAccountCredentials::Aws. Its
retrieve_subject_token sends requests to the imdsv2_session_token_url,
url and region_url fields of credential_source without the host check
that the other credential classes apply.

Any caller that builds credentials from a configuration it does not
fully control issues GET and PUT requests to hosts the configuration
names, including internal services and link-local metadata endpoints.

Problem types
-------------
- CWE-918 Server-Side Request Forgery (SSRF)

Workarounds
-----------
Ensure that every credentials configuration reaching the Application
Default Credentials flow comes from a trusted source.

Solutions
---------
Upgrade to a future Google-Auth release.

References
----------
https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm