CVE-2026-66901

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.09

Description Google::Auth for Perl allows server side request forgery (SSRF) and credential exfiltration due to unvalidated URLs read from the credentials JSON. The library fails to check hosts against the universe domain before making requests. In an external account configuration, the retrieve subject token function fetches credential source.url, and fetch access token posts the subject token to token url before sending the STS access token to service account impersonation url via an Authorization: Bearer header. Additionally, authorized user, impersonated service account, and service account configurations post client secrets, refresh tokens, source access tokens, or signed JWT assertions to the JSON-supplied token uri or impersonation URL. This allows an attacker who controls the configuration to force the application to send credentials to arbitrary hosts, including internal services and link-local metadata endpoints.

Recommendations Update Google::Auth to version 0.09 or later.