EUVD-2026-52921
GHSA-vjmh-7f4c-cx88
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Full RCE impact (C/I/A:H) with no library-level auth (PR:N), but AC:H because it hinges on the app consuming an attacker-influenced external_account+executable credential config rather than a default-reachable input.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as system($command), a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.
Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.
AnalysisAI
Command injection in Google::Auth for Perl before 0.06 lets an attacker who controls an Application Default Credentials configuration achieve arbitrary code execution. When a 'type: external_account' credentials JSON contains a credential_source.executable block, the Pluggable subclass runs the named command via a single-argument system($command), handing the whole string to /bin/sh -c, and copies the JSON's environment_variables into %ENV first - all with no opt-in gate (the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES check was added only in the fix). Reported by CPANSec with no public exploit identified at time of analysis and a low EPSS of 0.20%, but the code path is trivially reachable from the standard ADC flow via GOOGLE_APPLICATION_CREDENTIALS.
Technical ContextAI
Google::Auth is a Perl port of Google's authentication libraries implementing Application Default Credentials (ADC) and workload identity federation. The affected component is Google::Auth::ExternalAccountCredentials::Pluggable, which supports 'pluggable' external account credentials that obtain a subject token by executing a local helper binary. The root cause is CWE-78 (OS Command Injection): the library reads credential_source.executable.command from the credentials JSON and passes it to Perl's system() in list-less single-string form, which delegates to /bin/sh -c and performs shell metacharacter interpretation. make_creds routes any configuration containing credential_source.executable to the Pluggable subclass, so the sink is reached from the ordinary ADC entry point that reads the file named by GOOGLE_APPLICATION_CREDENTIALS. The CPE identifies the affected package as cpe:2.3:a:cjcollier:google::auth (the CJCOLLIER CPAN distribution 'Google-Auth').
RemediationAI
Upgrade to the vendor-released patch: Google::Auth 0.06 from CPAN, which is the primary and complete fix. Version 0.06 introduces a mandatory opt-in gate so pluggable executables run only when GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 is set, adds a command execution timeout, enforces output schema validation, and restricts external_account URLs (token_url, service_account_impersonation_url, credential_source.url) to googleapis.com or the configured universe_domain. If you cannot upgrade immediately, ensure the application never builds credentials from untrusted or externally influenced configuration: treat GOOGLE_APPLICATION_CREDENTIALS as pointing only to a file whose contents are fully operator-controlled, reject or strip any credential JSON whose 'type' is 'external_account' with a credential_source.executable block (configurations without that key never reach the vulnerable path), and run the application process with least privilege to limit blast radius. Note the trade-off: rejecting external_account/executable configs disables legitimate pluggable workload-identity-federation use. See the patch at https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95.patch and the advisory at https://seclists.org/oss-sec/2026/q3/435.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today