CVE-2026-66902 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-66902?
CVE-2026-66902 is a critical vulnerability in CJCOLLIER Google::Auth, published on 4 Aug 2026.
Official description
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.
Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.
Which versions are affected by CVE-2026-66902?
How do I fix CVE-2026-66902?
No fix has been published for CVE-2026-66902 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66902 being exploited?
There is no known exploitation of CVE-2026-66902 in the wild and no public exploit code.
Sources
Also known as GHSA-vjmh-7f4c-cx88.