CVE-2026-74760
Low risk· EPSS 2%Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Google::Auth versions 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, and the CLI exchanges it and stores the refresh token as the user's credentials.
Risk Assessment
The user's tools may then act as the attacker's account, leading to identity takeover and unauthorized access to resources. This requires local access to the victim's machine.
Recommendation
Upgrade Google::Auth to a version later than 0.12 that validates the state parameter. Until then, avoid running gcloud-auth login commands on shared machines.
Other vulnerabilities in Google::Auth
See all- CVE-2026-66902Critical
Google::Auth for Perl before version 0.06 runs a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command and runs it as `system($command)`, passing the whole string to /bin/sh -c. No opt-in gate guards the call, and the path is reached from the standard Application Default Credentials flow.
- CVE-2026-74759Low risk· EPSS 7%
Google::Auth version 0.12 for Perl allows server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. The Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without the host check applied by other credential classes.
- CVE-2026-66901High
Vulnerability in Google::Auth for Perl before version 0.09 allows SSRF and credential exfiltration. URLs taken from the credentials JSON are not validated against the universe domain, enabling requests to internal services and link-local endpoints with application credentials.
Original NVD description (English source)
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS