CVE-2026-66901 CJCOLLIER CVE debrief

Who should care

Developers and administrators using Google::Auth versions before 0.09 for Perl should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 0.09 or later, reviewing and validating URLs in credentials JSON, and implementing additional security measures to detect and prevent suspicious activity. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The Google::Auth library for Perl, versions before 0.09, allows server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The library reads URLs from the credentials JSON and requests them without validating their hosts against the universe domain. This allows an attacker to craft URLs that can reach internal services, link-local metadata endpoints, and other sensitive hosts, potentially leading to credential exfiltration. Versions 0.06, 0.07, and 0.08 introduced partial fixes, with version 0.09 providing a complete solution.

Defensive priority

Organizations using Google::Auth versions before 0.09 for Perl should prioritize upgrading to version 0.09 or later to address the server side request forgery and credential exfiltration vulnerability.

Recommended defensive actions

• Upgrade to Google::Auth version 0.09 or later
• Review and validate URLs in credentials JSON
• Implement additional security measures to detect and prevent suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON in Google::Auth versions before 0.09 for Perl. Evidence from the CVE record and source references indicates that versions 0.06, 0.07, and 0.08 introduced partial fixes, with version 0.09 providing a complete solution.

Official resources