External risk intelligence

Google Auth for Perl Server-Side Request Forgery Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74759

The vulnerability exists in a Perl library used for managing AWS external account credentials. While the library is network-capable, it is typically used within backend application logic or scripts rather than being directly exposed as an internet-facing service. Exploitation requires an attacker to control the configuration input, which is uncommon in standard deployment patterns.

Server-Side Request Forgery

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a Google authentication library for Perl, specifically related to how it handles AWS external account credentials. It could allow attackers to make unintended requests to internal services or metadata endpoints if they can influence the configuration used. The main concern is confirming if this specific library and configuration are in use within your environment.

Authentication library allows rogue requests.
Impacts systems using AWS external credentials.
Verify usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending crafted requests to a system using a vulnerable version of Google::Auth for Perl. This could happen if the system allows external input to define AWS external account credentials. The vulnerability lies in how the library handles URLs for obtaining AWS credentials, specifically by not validating them properly. This could enable an attacker to trick the application into sending requests to unintended internal or external services.

Requires attacker-controlled configuration.
Triggered by unvalidated credential source URLs.
Leads to server-side request forgery.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to make arbitrary network requests on behalf of a system using the affected software. When an attacker can influence the configuration of AWS external account credentials, the system may issue GET and PUT requests to hosts specified in that configuration. This could include internal services or metadata endpoints accessible only within the private network.

Internal services and metadata endpoints.
Requests to arbitrary hosts via configuration.
Unauthorized access to internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google::Auth for Perl, which allows server-side request forgery through unvalidated `credential_source` URLs, likely impacts application owners and platform teams responsible for managing external AWS credentials. The initial step is to identify all instances of this library, confirm their reachability and criticality, and then determine the accountable owner to plan remediation.

Application and platform teams own the issue.
Verify vulnerable library and credential configurations.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google::Auth for Perl?

Google::Auth is a library for the Perl programming language used to handle authentication processes. Version 0.12 specifically includes functionality to manage AWS external account credentials, enabling applications to securely interact with Google Cloud services using identity providers outside of Google's native ecosystem.

What does CVE-2026-74759 mean?

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability, classified as CWE-918. It means the library fails to validate specific URL inputs when configuring AWS credentials. Consequently, an application using this library might be tricked into sending unauthorized network requests to arbitrary destinations, including sensitive internal services.

How is this vulnerability triggered?

An attacker must be able to influence the external account configuration used by the library. When the application processes these settings, it performs GET or PUT requests to the provided URLs. The vulnerability does not trigger if the application configuration is static, hardcoded, or strictly controlled by trusted internal processes.

Do I need to worry about this CVE?

Halo Surface Signal indicates that this vulnerability is unlikely to be exposed on the internet because the library typically functions within backend logic rather than as a public-facing service. You should prioritize assessment if your applications dynamically construct AWS credential configurations using untrusted or user-provided input.

When should I take action to secure this?

Begin by identifying all applications in your environment that utilize the Google::Auth Perl library. Verify if these applications use the AWS external account feature and whether configuration inputs are reachable by external actors. Once identified, consult your development team to restrict or sanitize all credential source URLs.

References

metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.