CVE-2026-66902 in Google::Auth
Summary
by MITRE • 08/05/2026
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.
The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.
Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability represents a critical remote code execution flaw in Google::Auth Perl library versions prior to 0.06, where external_account credential configurations can be exploited to execute arbitrary commands on the target system. The issue stems from improper input validation and sanitization within the Pluggable subclass implementation that handles external account credentials. When the library processes a credential configuration containing credential_source.executable.command, it directly passes this value to Perl's system() function without any sanitization or gating mechanism, creating a classic command injection vulnerability.
The technical implementation of this flaw occurs through the use of system($command) with a single argument, which effectively delegates execution to /bin/sh -c, allowing full shell command interpretation. The credential_source.executable.environment_variables map from the JSON configuration is first copied into the process environment variables using %ENV, potentially providing additional attack surface for environment manipulation. This design pattern bypasses any input validation that might normally occur in a secure implementation, as there is no opt-in mechanism or explicit permission check required to trigger the execution path. The vulnerability is automatically triggered when make_creds encounters a configuration with credential_source.executable present, making it reachable through standard Application Default Credentials flows.
The operational impact of this vulnerability is severe and can result in complete system compromise when applications process untrusted credential configurations. An attacker who can influence the contents of a credential file or modify the GOOGLE_APPLICATION_CREDENTIALS environment variable can execute arbitrary commands with the privileges of the running application process. This affects any system that uses Google::Auth for authentication and relies on external_account credentials, particularly in cloud environments where applications may run with elevated permissions. The vulnerability is especially dangerous in containerized environments, CI/CD pipelines, or systems with multiple privilege levels, as it can enable attackers to escalate privileges or exfiltrate sensitive data.
The vulnerability maps directly to CWE-78 "Improper Neutralization of Special Elements used in an OS Command" and aligns with ATT&CK technique T1059.001 "Command and Scripting Interpreter: PowerShell" and T1059.003 "Command and Scripting Interpreter: Windows Command Shell". Organizations should immediately upgrade to Google::Auth version 0.06 or later, which implements proper input validation and sanitization for command execution. Additionally, administrators should audit credential configurations in use, implement least privilege principles for credential files, and consider implementing runtime monitoring for suspicious command executions. The fix should include validating that commands contain only allowed characters and implementing explicit opt-in mechanisms for external command execution, rather than relying on implicit trust of configuration values.
The vulnerability demonstrates the critical importance of secure input handling in authentication libraries and highlights how seemingly innocuous credential configuration features can become attack vectors when proper security controls are missing. Organizations using this library should conduct immediate security assessments of their credential management practices and ensure that all credential configurations are properly validated before being processed by authentication libraries. The issue also underscores the need for comprehensive security testing of third-party libraries, particularly those handling authentication flows and external system interactions.