External risk intelligence

Perl Google Auth Command Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-66902

This vulnerability exists in a client-side library used by local applications. It executes commands based on local configuration files (Application Default Credentials). It is not a network-exposed service or internet-facing endpoint; exploitation requires an attacker to already have control over the local environment or configuration files.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue involves a vulnerability in a widely used authentication library for Perl. It allows for the execution of arbitrary commands if applications use specific external account credential configurations that are not fully controlled by the application developer. This could potentially lead to unauthorized command execution within the application's environment.

A flaw allows running unexpected commands.
Matters if applications trust external credentials.
Confirm relevance and exposure of credential sources.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by providing a malicious configuration file. This file would contain a command that the vulnerable library then executes with the application's privileges.

Entry condition: Malicious credentials file present.
Trigger point: Application reads external account credentials.
Resulting risk: Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When an application uses Google::Auth for Perl with a specially crafted external account credential configuration, it could execute arbitrary commands. This occurs when the application reads a credential source that specifies an executable command, and that command is then run by the application's process without further validation. This could impact system integrity and confidentiality if the executed command is malicious.

System commands configured in credentials.
Command execution via `system()` call.
Unauthorized code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `Google-Auth` Perl library's handling of external account credentials presents a critical risk, as it executes commands directly from configuration files without sufficient gating. Application owners, potentially in conjunction with platform or infrastructure teams, must first identify all instances of this library, particularly those configured with `credential_source.executable`, and assess their reachability and business criticality. Coordination with vendor-management teams may be necessary if the affected applications are third-party.

Application owners, platform teams.
Verify affected library, credential configurations.
Plan risk-based remediation, engage vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google::Auth for Perl?

Google::Auth is a Perl library developers use to handle authentication for Google Cloud services. It simplifies how applications connect to cloud resources by automatically managing credentials, often using the standard Application Default Credentials flow to identify the application and authorize its requests.

Why is CVE-2026-66902 considered a security weakness?

This vulnerability involves OS Command Injection (CWE-78). The library takes a command string provided in a credential configuration file and executes it directly via a system call without validation. Because it also incorporates environment variables from that same file, an attacker can manipulate the application's runtime environment.

How is this command execution triggered?

The flaw triggers when the library processes a configuration file containing a 'credential_source.executable' field. If your application does not use this specific 'external_account' configuration, it does not trigger the vulnerable code path. The risk depends entirely on whether the application reads an untrusted or modified credentials file.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is unlikely to be an internet-facing threat because the library resides on the client side. Exploitation requires an attacker to already have sufficient access to modify local configuration files or the local environment where the application resides, rather than attacking a network service directly.

How do I respond if I am using this Perl library?

First, audit your environment to identify where Google::Auth is deployed. Specifically, look for any applications configured to use external account credentials. If you find these configurations, prioritize updating the library to version 0.06 or later, which addresses this command execution path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.