/ 
Google-Auth-0.06
/ Google::Auth::EnvironmentVars
Security Advisories (1)
CVE-2026-66901 (2026-08-04)

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL. Any caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google. Version 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials.

NAME

Google::Auth::EnvironmentVars - Environment variables used by Google::Auth

VERSION

Version 0.05

SYNOPSIS

Canonical package for reading environment variables used with Google::Auth

METHODS

PROJECT

This env variable is used by Google::Auth to explicitly set a project ID. This environment variable is also used by the Google Cloud Perl Library.

LEGACY_PROJECT

This environment variable is used instead of the current one in some situations (such as Google App Engine).

CREDENTIALS

Environment variable defining the location of Google application default credentials

CLOUD_SDK_CONFIG_DIR

The environment variable name which can replace ~/.config if set

GCE_METADATA_ROOT

This and the following variable allow for customization of the addresses used when contacting the GCE metadata service.

GCE_METADATA_IP

AUTHOR

C.J. Collier, <cjac at google.com>

BUGS AND SUPPORT

Please report any bugs or feature requests to the GitHub issue tracker at https://github.com/GoogleCloudPlatform/google-auth-library-perl/issues or via RT at https://rt.cpan.org/Dist/Display.html?Name=Google-Auth.

You can also look for information at:

ACKNOWLEDGEMENTS

LICENSE AND COPYRIGHT

Copyright 2020,2021 Google LLC

This program is released under the following license: Apache 2.0