CVE-2026-66902

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.06

Description An issue exists where the software executes a command specified in an external account credentials JSON file through an ungated system call. The Pluggable subclass retrieves the credential source.executable.command from the JSON and executes it using the system($command) function, which passes the entire string to /bin/sh -c. Before execution, the environment variables map from the JSON is copied into the %ENV variable. This path is triggered during the standard Application Default Credentials flow when a configuration with "type": "external account" and a credential source.executable is read from the file designated by GOOGLE APPLICATION CREDENTIALS. Consequently, any application building credentials from a configuration it does not fully control may execute embedded commands with the privileges of the application process.

Recommendations Update to version 0.06 or later.