CVE-2026-74759: SSRF in Google::Auth for Perl AWS Credentials

CVE-2026-74759: critical SSRF in Google::Auth Perl affecting AWS credentials. CVSS 9.8.

CVE-2026-74759 is a Server-Side Request Forgery (SSRF) vulnerability in Google::Auth version 0.12 for Perl. The flaw allows attackers to send unauthorized requests to internal services and cloud metadata endpoints through AWS external account credential configurations.

The library does not validate hosts in the credential_source fields of AWS external account configurations. The ExternalAccountCredentials::Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without verifying the destination host, allowing access to internal services and metadata endpoints that should be isolated.

The CVSS score is 9.8, with critical severity declared. The vulnerability was published on the NVD on November 1, 2026. No official patch is yet available. On X, the high risk of the flaw and the lack of immediate fixes have been reported.

For administrators and security teams: immediately inventory Google::Auth 0.12 in your Perl applications. Implement network controls that restrict outbound requests to metadata endpoints. Monitor external credential configurations for anomalous URLs. Stay updated on patches and plan upgrades as soon as available.

At a glance

What: A Server-Side Request Forgery (SSRF) vulnerability in Google::Auth version 0.12 for Perl. The library does not validate destination hosts in credential_source fields for AWS external account configurations (imdsv2_session_token_url, url, region_url), allowing unauthorized requests to internal services and cloud metadata endpoints.
Severity: CVSS 9.8 (critical). The vulnerability enables reaching internal services and metadata endpoints that should be inaccessible, creating significant risks for data confidentiality and cloud credential security.
Affected versions: Google::Auth version 0.12 for Perl. Perl applications using this version of the library to manage AWS external credentials are exposed to the flaw.
Fix: Not reported. No patch has been made available at the time of publication (November 1, 2026). It is recommended to check official Google::Auth updates.
Status: Vulnerability published on NVD on November 1, 2026. Reported with critical severity. Public exploits or patch updates are not confirmed at the time of analysis (November 6, 2026).
Action: Inventory the use of Google::Auth 0.12 in Perl applications. Restrict outbound requests to metadata endpoints with network rules. Monitor credential configurations for anomalous URLs. Stay updated on patches and plan upgrades as soon as available.

Sources: NVD, CVE-2026-74759

← All articles