CVE-2026-66901 — Threat Intelligence Report

Executive Summary

CVE-2026-66901 is a high-severity server-side request forgery (SSRF) and credential exfiltration vulnerability affecting the CPANSec Google::Auth Perl module, versions prior to 0.09. The flaw permits an attacker who can control or influence the credentials JSON configuration to redirect the library's outbound HTTP requests to arbitrary hosts, including internal services and cloud metadata endpoints, thereby exposing sensitive authentication credentials. This vulnerability carries a CVSS score of 7.5 (High) with a public PoC available, and affects all applications that build credentials from configuration files not fully under their control.

Technical Analysis

The vulnerability resides in the URL validation logic of the Google::Auth Perl library. The library reads all request URLs directly from the credentials JSON configuration file and, prior to version 0.09, did not validate that the target host of each URL falls within an approved universe domain (e.g., googleapis.com). This oversight enables SSRF attacks and credential exfiltration across multiple authentication flow configurations.

Affected Configuration Paths:

1. external_account configuration — The library calls retrieve_subject_token which fetches credential_source.url using headers read from the same JSON. Subsequently, fetch_access_token POSTs the subject token to token_url, and then transmits the STS access token to service_account_impersonation_url in an Authorization: Bearer header.

2. authorized_user configuration — The library POSTs the client secret and refresh token to a JSON-supplied token_uri.

3. impersonated_service_account configuration — The library POSTs the source access token to a JSON-supplied impersonation URL.

4. service_account configuration — The library POSTs a signed JWT assertion to its JSON-supplied token URI. The assertion is bound to the aud field, which constrains replayability against Google, though the same assertion can still be leveraged to exfiltrate credential material to a malicious endpoint.

Attack Vector Mechanics:

An attacker who can control the credentials JSON — whether through a compromised configuration file, supply-chain attack, malicious OAuth client package, or spear-phishing attempt delivering a rogue configuration — can point any of the above URLs to an internal hostname (e.g., http://169.254.169.254, http://metadata.google.internal, or http://10.0.0.5:8080) or to an attacker-controlled server. Because the application runs these requests from its own network position, the attacker gains access to internal services reachable from the application host and obtains the credentials embedded in each request.

Partial Mitigations in Earlier Versions:

• Version 0.06 introduced a _validate_url host check within the external_account class, but this validation was keyed on a universe_domain value read from the same credentials JSON — meaning an attacker in control of that JSON could simply set a permissive universe domain. The check was therefore ineffective.

• Version 0.07 gated the JSON-supplied universe domain behind the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1 environment variable, requiring explicit opt-in by the application. This partially mitigated the bypass by default, but only for the external_account class, leaving other configurations still exposed.

Fundamental Fix in 0.09:

Version 0.09 performs proper host validation against googleapis.com or a universe domain explicitly pinned by the application code, rather than trusting the credentials JSON.

Exploitation Scenarios

Scenario 1: Cloud Metadata Endpoint Exfiltration via external_account

1. Reconnaissance: The attacker identifies a Perl application using Google::Auth with Application Default Credentials (ADC). They deliver a crafted credentials JSON to the application through a malicious third-party library, dependency confusion attack, or a compromised configuration repository.

2. Weaponization: The attacker crafts a credentials JSON with an external_account configuration where:

   • credential_source.url points to http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
   • token_url points to an attacker-controlled HTTPS server
   • service_account_impersonation_url points to an attacker-controlled HTTPS server

3. Execution: When the application initiates authentication, the library:

   • Fetches the AWS/cloud instance role credentials from the link-local metadata endpoint (SSRF)
   • POSTs the subject token to the attacker's server
   • Sends the STS access token with Authorization: Bearer header to the attacker-controlled service_account_impersonation_url

4. Post-Exploitation: The attacker captures both the cloud instance credentials and the STS access token, gaining unauthorized access to cloud resources the application could access.

Scenario 2: Internal Service Targeting via authorized_user

1. Reconnaissance: The attacker gains write access to an environment variable or configuration file the application reads for GOOGLE_APPLICATION_CREDENTIALS, or controls a dependency that passes a credentials_hash to the library.

2. Weaponization: The attacker crafts an authorized_user JSON with:

   • client_id and client_secret (potentially the real application credentials)
   • token_uri set to http://10.0.0.5:8080/internal/collect

3. Execution: The library POSTs the OAuth refresh token and client secret to the internal endpoint, which is accessible only from within the application's network segment.

4. Post-Exploitation: The attacker captures valid OAuth refresh tokens and client secrets from an interior vantage point, potentially using them to impersonate the application or user against legitimate Google APIs.

Scenario 3: JWT Assertion Interception

1. Reconnaissance: The attacker targets a service_account configuration used in a CI/CD pipeline.

2. Weaponization: The attacker sets token_uri in the JSON to http://attacker.example.com/collect.

3. Execution: The library POSTs the signed JWT assertion. Though bound to aud and non-replayable against Google, the JWT is still delivered to the attacker's server.

4. Post-Exploitation: The attacker captures the signed assertion, potentially revealing service account identity metadata, and can relay it to other Google services that accept the assertion if aud matches, depending on the targeted service configuration.

Impact Assessment

CVSS Breakdown: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector: Network — exploitable remotely
• Attack Complexity: Low — no special conditions required
• Privileges Required: None — no prior authentication needed
• User Interaction: None — no victim interaction required
• Scope: Unchanged
• Confidentiality Impact: High — full credential disclosure
• Integrity Impact: None
• Availability Impact: None

Business Impact:

• Credential exposure: OAuth refresh tokens, client secrets, STS access tokens, and signed JWTs can be intercepted, potentially granting long-term unauthorized access to Google Cloud resources.
• Internal network reconnaissance: SSRF enables probing of internal services, cloud metadata endpoints, and other infrastructure not directly exposed to the internet.
• Supply-chain risk: Any application accepting credentials JSON from third-party sources without strict validation is at risk.
• Compliance impact: Organizations subject to PCI-DSS, HIPAA, or SOC 2 may face audit findings due to inadequate input validation of credential configuration.

Affected Systems: All Perl applications using Google::Auth prior to 0.09, including those relying on ADC, standalone OAuth flows, and service account authentication for Google Cloud services.

Detection Guidance

Sigma Rule

title: Google::Auth SSRF - Suspicious Credential JSON URLs
id: 5f8e61a2-3c9b-4e7a-b2f1-7d1c8e9a3b5f
status: experimental
description: Detects Google::Auth processes attempting to contact internal or non-googleapis hosts due to malicious credential JSON
logsource:
    category: process_creation
    product: linux
detection:
    selection_access_token_url:
        Image|endswith: '/perl'
        CommandLine|contains:
            - '169.254.169.254'
            - 'metadata.google'
            - 'token_uri'
            - 'http://10.'
            - 'http://192.168.'
            - 'http://172.16.'
    selection_env:
        env_var:
            - 'GOOGLE_APPLICATION_CREDENTIALS'
    condition: selection_access_token_url and selection_env
level: high
falsepositives:
    - Legitimate use of custom universe domains in exotic environments
tags:
    - attack.t1190
    - cve.2026.66901

YARA Rule

rule Google_Auth_SSRF_CredExfil {
    meta:
        author = "Valtersit Security Research"
        description = "Detects malicious credentials JSON targeting Google::Auth before 0.09"
        cve_id = "CVE-2026-66901"
        date = "2026-01-01"
    strings:
        $external_account = "external_account" ascii wide nocase
        $credential_source = "credential_source" ascii wide nocase
        $token_uri = "token_uri" ascii wide nocase
        $service_account_impersonation = "service_account_impersonation_url" ascii wide nocase
        $suspicious_host1 = "169.254.169.254" ascii wide
        $suspicious_host2 = "metadata.google.internal" ascii wide nocase
        $suspicious_host3 = "http://10." ascii wide
        $suspicious_host4 = "http://192.168." ascii wide
        $suspicious_host5 = "http://172." ascii wide
        $universe_domain = "universe_domain" ascii wide nocase
    condition:
        (uint16(0) == 0x5B7B or uint16(0) == 0x5B7D) and
        ($external_account or $token_uri or $service_account_impersonation) and
        2 of ($suspicious_host*) and
        filesize < 50KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66901 Google::Auth SSRF to Metadata Endpoint"; content:"Authorization"; http_header; content:"Bearer"; http_header; content:"169.254.169.254"; http_uri; sid:6709901; rev:1; metadata:cve CVE-2026-66901, attack_target Client_Endpoint, deployment Perimeter;)
alert http any any -> any any (msg:"CVE-2026-66901 Google::Auth POST to Non-Google Host with OAuth Token"; http_method; content:"POST"; http_method; content:"client_secret"; http_client_body; content:"refresh_token"; http_client_body; content:"Host"; http_header; pcre:"/^Host\x3a (?!\S*googleapis\.com)/mi"; sid:6709902; rev:1; metadata:cve CVE-2026-66901;)
alert http any any -> any any (msg:"CVE-2026-66901 Google::Auth SSRF to RFC1918 Address"; content:"POST"; http_method; content:"client_secret"; http_client_body; content:"http://10."; http_uri; sid:6709903; rev:1; metadata:cve CVE-2026-66901;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where event.action == "exec" and process.args : "*.pl" and process.env.GOOGLE_APPLICATION_CREDENTIALS != null]
  [network where process.name == "perl" and
     (destination.ip == "169.254.169.254" or
      destination.domain == "metadata.google.internal" or
      cidrMatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")) and
     event.outcome == "success"]

Splunk SPL Query

index=main sourcetype=stream:http 
| search (uri_path="*token*" OR uri_path="*OAuth*" OR uri_path="*metadata*")
| eval is_suspicious = if(match(uri, "169\.254\.169\.254") OR match(uri, "metadata\.google") OR match(uri, "10\.[0-9]+\.[0-9]+\.[0-9]+") OR match(uri, "192\.168\.") OR match(uri, "172\.(1[6-9]|2[0-9]|3[01])\."), 1, 0)
| eval is_google = if(match(http_host, "googleapis\.com$") OR match(http_host, "google\.com$"), 1, 0)
| where is_suspicious=1 AND is_google=0
| table _time, src_ip, dest_ip, http_host, uri, http_method, http_user_agent, bytes_out
| sort -_time

Wazuh OSSEC Rule

<group name="ssrf,">
  <rule id="669010" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">\.*169\.254\.169\.254\.*</field>
    <description>CVE-2026-66901: Google::Auth SSRF attempt targeting cloud metadata endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.t1190,cve.2026.66901,</group>
  </rule>
  <rule id="669011" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*metadata\.google\.internal\.*</field>
    <description>CVE-2026-66901: Google::Auth SSRF attempt targeting GCP metadata service</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.t1190,cve.2026.66901,</group>
  </rule>
  <rule id="669012" level="10">
    <if_sid>669010,669011</if_sid>
    <match>Authorization|Bearer|client_secret|refresh_token</match>
    <description>CVE-2026-66901: Credential material observed in SSRF request</description>
    <group>attack.t1190,cve.2026.66901,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources (NVD and CNA) confirm the fix in version 0.09. This CVE is not listed in CISA KEV.

1. Immediate Mitigations (Before Patching)

• Trusted sources only: Ensure every credentials configuration reaching the Application Default Credentials flow originates from a trusted source. Disable application support for externally-provided credential JSON files where possible.
• Network egress filtering: Restrict outbound traffic from application hosts to only allow connections to *.googleapis.com (and any required legitimate external services). Block RFC 1918 address ranges at the host firewall for outgoing application traffic.
• Environment variables: Set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=0 (or unset it entirely) to prevent operationally-supplied universe domains from being honored by versions 0.07 and later.
• Audit credentials: Review the provenance of every credentials JSON file deployed in your environment.

2. Patch / Upgrade Steps

• Affected: All versions prior to 0.09.
• Fixed: Version 0.09+ validates each URL host against googleapis.com or a universe domain pinned explicitly by the application before making the request.
• Upgrade command:

  cpanm Google::Auth@0.09
  

  or via cpan:

  cpan> install Google::Auth
  

• Upgrading through the system package manager (e.g., apt install libgoogle-auth-perl for Debian-based systems) may also be appropriate if the distribution ships a patched package.

3. Long-Term Hardening

• Input validation: Use a centralized configuration validation layer that rejects credential JSON containing URLs to non-googleapis hosts.
• Runtime monitoring: deploy eBPF or host-based monitoring that flags Perl processes initiating outbound connections to non-allowlisted hosts.
• Secrets management: migrate to a managed secrets manager (e.g., HashiCorp Vault, GCP Secret Manager) that validates credentials at the source before they reach the application.
• Regular dependency scanning: Incorporate CPAN dependency auditing for Google::Auth into CI/CD pipelines to flag versions below 0.09.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66901 — Official CVE record with NVD description and CVSS vector.
2. CNA Advisory: CPANSec advisory for Google::Auth 0.09 release notes — vendor-published description of the fix.
3. Nuclei / Exploit Databases: Public PoC references exist for this vulnerability; monitor exploit-db and similar repositories for proof-of-concept code updates.
4. CISA KEV: This vulnerability is currently not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS score: 0.00333 (25.9% percentile) suggests low immediate exploitation likelihood but non-zero threat.

Known Threat Actor Campaigns: No specific campaigns have been reported in public data at the time of writing. However, given the public PoC status and the vulnerability's applicability to cloud credentials, operators should expect threat actors to weaponize this flaw for cloud account takeover, particularly against organizations using Google Cloud services with federated workload identity pools.

Report generated by Valtersit Threat Intelligence. This document is for informational purposes and should be used in accordance with applicable laws and regulations.