Google::Auth for Perl (2 CVEs)
Affects versions 0.11 through 0.12; no fixed versions or exploitation stated.
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state.
- Versions 0.12 allow SSRF in AWS credentials
- Versions 0.11-0.12 accept OAuth codes from local processes
- No fixed versions or exploitation mentioned
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-74759+1 related CVE | SSRF in Google::Auth for Perl AWS credential_source | — | — |
From the original article
Posted by Robert Rothenberg on Nov 01 CVE-2026-74759 Google::Auth versions 0. 12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials CVE-2026-74760 Google::Auth versions from 0. 11 through 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.