CVE-2026-66902

Summary

Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.

The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as system($command), a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.

Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.

Affected Software

VendorProductVersion RangeStatus
CJCOLLIERGoogle::Auth0 < 0.06affected

Weaknesses

  • CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-829: CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Workarounds

For deployments that cannot upgrade to 0.06, apply the upstream fix commit, or ensure that every credentials configuration reaching the Application Default Credentials flow comes from a trusted source.

ADP Enrichment

CVE Program Container

Additional References

References