CVE-2026-74760 debrief: Google::Auth for Perl vulnerability allows local attackers to submit authorization codes for their own Google accounts, potentially leading to unauthorized access. This vulnerability affects Google::Auth versions from 0.11 through 0.12 for Perl, specifically in the gcloud-auth login and application-default login commands. The vulnerability arises because the gcloud-auth login callb [truncated]
CVE-2026-74759 debrief: Google::Auth Perl library versions 0.12 is vulnerable to server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields o [truncated]
The Google::Auth Perl library, version before 0.06, has a critical vulnerability (CVE-2026-66902) that allows an attacker to execute arbitrary commands with the privileges of the application process. This vulnerability is caused by the Pluggable subclass reading credential_source.executable.command from the credentials JSON and running it as `system($command)`, a single argument call that passes the whole [truncated]
The Google::Auth library for Perl, versions before 0.09, allows server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. This vulnerability affects developers and administrators using these versions, who should be aware of the potential risks and take steps to mitigate them. The library reads URLs from the credentials JSON and requests them without vali [truncated]
