EUVD-2026-52920
GHSA-xxpm-5c34-x4c3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
PR:L reflects that influencing the credentials JSON requires at minimum low-privilege access to the application; AV:N and C:H stand given token exfiltration over network requests.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL.
Any caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google.
Version 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials.
AnalysisAI
Server-side request forgery in Google::Auth for Perl (versions before 0.09) allows credential exfiltration to attacker-controlled hosts when applications process credentials JSON they do not fully control. The library makes outbound HTTP requests to URLs read directly from the credentials JSON - including token endpoints, impersonation URLs, and credential source URLs - without validating that those hosts belong to googleapis.com or a pinned universe domain. All four credential types (external_account, authorized_user, impersonated_service_account, service_account) are affected, and each carries live credentials (subject tokens, refresh tokens, client secrets, or signed JWT assertions) in those requests. No public exploit has been identified at time of analysis, and EPSS is 0.18% (8th percentile), indicating low observed exploitation pressure despite the CVSS 7.5 score.
Technical ContextAI
Google::Auth is the official Perl client library for Google Cloud Platform authentication (CPAN: cpe:2.3:a:cjcollier:google::auth:*:*:*:*:*:*:*:*), distributed by CPANSec under author CJCOLLIER. The library implements the Application Default Credentials pattern, supporting four credential flows that each issue outbound HTTP requests to token or impersonation endpoints. The root cause (CWE-918: Server-Side Request Forgery) is the absence of host validation against a pinned expected domain before any of those outbound requests are made. Because all URL fields - credential_source.url, token_url, service_account_impersonation_url, token_uri - are read verbatim from the credentials JSON, an attacker who controls that JSON can redirect the library's HTTP calls to arbitrary hosts, including link-local metadata endpoints (169.254.169.254) and internal network services. The fix, implemented progressively across versions 0.06 through 0.09, introduced a _validate_url method that uses the Perl URI module to parse and compare the host against googleapis.com and the pinned universe_domain, rejecting any URL whose host does not match. Notably, version 0.06's initial fix was itself incomplete: universe_domain was read from the same untrusted credentials JSON, making the check bypassable until version 0.07 gated custom domains behind the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1 environment variable, and version 0.08 moved the pin decision to an explicit constructor argument. Version 0.09 extended coverage to ServiceAccountCredentials, completing the fix.
RemediationAI
Upgrade Google::Auth to version 0.09 or later via CPAN (cpan install Google::Auth or cpanm Google::Auth). This is the first release where _validate_url is applied to all four credential classes. The upstream commits are available at https://github.com/GoogleCloudPlatform/google-auth-library-perl/commit/c95c77e70bec94f17e239d88050f843ea1cade95, cd42bdef53afcc4531161e85e91d0d5997e01324, 9b5157062acc605ca9e6c507b910587f4829ce9e, and cbbb07804e3f8cc7cf9638ecc9c2097d80a9ef50. If immediate upgrade is not possible, a compensating control is to audit and strictly control which credentials JSON files are loaded by the application, rejecting any JSON that originates from user input, external APIs, or unvalidated storage paths. Block outbound HTTP from the application host to link-local ranges (169.254.0.0/16) and RFC-1918 private ranges via egress firewall rules; note that this does not prevent exfiltration to attacker-controlled public hosts and is not a substitute for patching. Do not rely on versions 0.06-0.08 as complete mitigations, since each covers only a subset of credential types.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today