CVE-2026-74759 CJCOLLIER CVE debrief

Who should care

Defenders of systems using Google::Auth Perl library, especially those with AWS external account credentials, should assess exposure and verify credential_source URL validation to prevent potential server-side request forgery attacks.

Why it matters

CVE-2026-74759 allows server-side request forgery in Google::Auth Perl library, impacting defenders of systems using AWS external account credentials. They must assess exposure, verify credential_source URL validation, and restrict access to internal services and metadata endpoints.

• Potential unauthorized access to internal services
• Possible data breaches via metadata endpoints
• Risk of lateral movement within compromised networks
• Need for verification of credential_source URL validation

Technical summary

Google::Auth versions 0.12 for Perl allow server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.

Defensive priority

Assess exposure in Google::Auth Perl library usage, verify credential_source URL validation, and restrict access to internal services and metadata endpoints.

Recommended defensive actions

• Assess exposure in Google::Auth Perl library usage
• Verify credential_source URL validation
• Restrict access to internal services and metadata endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Google::Auth versions 0.12 for Perl, allowing server-side request forgery via unvalidated credential_source URLs in AWS external account credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.