CVE-2026-74759 | Google Auth 0.12 Aws External Account Credentials Aws.pm retrieve_subject_token imdsv2_session_token_url/url/region_url server-side request forgery

A vulnerability has been found in Google Auth 0.12 and classified as critical. The affected element is the function retrieve_subject_token of the file lib/Google/Auth/ExternalAccountCredentials/Aws.pm of the component Aws External Account Credentials. The manipulation of the argument imdsv2_session_token_url/url/region_url leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-74759. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More