CVE-2026-66902: Google::Auth Perl Library RCE Vulnerability

CVE-2026-66902 Overview

CVE-2026-66902 is a command injection vulnerability [CWE-78] in the Google::Auth Perl library, affecting versions before 0.06. The flaw resides in the Pluggable subclass of ExternalAccountCredentials, which reads the credential_source.executable.command field from a credentials JSON file and executes it via system($command). Because system is called with a single string argument, Perl passes the value to /bin/sh -c, enabling shell interpretation. The library also copies attacker-controlled environment_variables into %ENV before invocation. No opt-in gate protects the call, so any application resolving credentials from an untrusted GOOGLE_APPLICATION_CREDENTIALS file executes arbitrary commands.

Critical Impact
Attackers who control an Application Default Credentials JSON file achieve remote code execution with the privileges of the calling Perl application process.

Affected Products

Google::Auth for Perl versions prior to 0.06
Applications using Google::Auth::ExternalAccountCredentials::Pluggable
Perl services consuming GOOGLE_APPLICATION_CREDENTIALS from untrusted sources

Discovery Timeline

2026-08-04 - CVE-2026-66902 published to NVD
2026-08-04 - Openwall OSS-Security disclosure published
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66902

Vulnerability Analysis

The vulnerability originates in Google::Auth::ExternalAccountCredentials::Pluggable, which implements support for pluggable external account credentials. When make_creds encounters a credentials JSON containing credential_source.executable, it selects the Pluggable subclass and invokes the executable command specified in the configuration.

The unsafe pattern is a system($command) call with a single scalar argument. Perl's system function, when invoked with a single string, delegates parsing to /bin/sh -c, allowing shell metacharacters such as ;, |, &&, and backticks to inject arbitrary commands. Before the call, the library populates %ENV from credential_source.executable.environment_variables, giving attackers additional control over the execution environment.

The standard Application Default Credentials (ADC) flow reaches this code path whenever a JSON file with "type": "external_account" and an executable block is loaded, typically via the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Root Cause

The upstream Google authentication libraries in other languages require the environment variable GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 before running pluggable executables. The Perl implementation omitted this gate entirely, treating any configuration file as trusted input for command execution.

Attack Vector

An attacker who can write or replace the file referenced by GOOGLE_APPLICATION_CREDENTIALS, influence its contents through supply chain or configuration injection, or convince an application to load a crafted JSON file achieves code execution as the running process. No authentication or user interaction is required beyond triggering the credential load.

perl

# Patch excerpt: Google-Auth/lib/Google/Auth/ExternalAccountCredentials/Pluggable.pm
 sub retrieve_subject_token {
     my ($self) = @_;
 
+    if ( ($ENV{GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES} // '0') ne '1' ) {
+        $log->errorf('Pluggable credentials are not enabled. Set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 to enable.');
+        Google::Auth::Error->throw('Pluggable credentials are not enabled. Set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 to enable.');
+    }
+
     my $source = $self->credential_source;
     my $exec   = $source->{executable};
     if ( !defined $exec ) {

Source: GitHub commit c95c77e

Detection Methods for CVE-2026-66902

Indicators of Compromise

Perl processes spawning child shells (/bin/sh -c) with unexpected command arguments while loading Google credentials
Presence of external_account type JSON files containing a credential_source.executable.command field pointing to non-standard binaries or shell metacharacters
Unexpected environment variables set on Perl processes matching keys defined in credential_source.executable.environment_variables
Modifications to files referenced by the GOOGLE_APPLICATION_CREDENTIALS environment variable

Detection Strategies

Audit installed Google::Auth versions across Perl deployments and flag any release earlier than 0.06
Monitor process creation events for Perl interpreters spawning sh, bash, or unusual executables during authentication flows
Inspect JSON files matching the ADC schema for the executable key and validate their provenance

Monitoring Recommendations

Log and alert on writes to paths referenced by GOOGLE_APPLICATION_CREDENTIALS on servers running Perl workloads
Track outbound network connections from Perl processes that deviate from documented Google API endpoints
Enable command-line auditing (auditd, Sysmon for Linux) to capture the full argv of shell processes descended from Perl

How to Mitigate CVE-2026-66902

Immediate Actions Required

Upgrade Google::Auth to version 0.06 or later on all Perl systems
Verify that GOOGLE_APPLICATION_CREDENTIALS points only to files owned and controlled by the application account
Remove or reject any external_account credential files containing a credential_source.executable block that is not explicitly required

Patch Information

The fix is delivered in Google::Auth 0.06 via commit c95c77e. It introduces a mandatory GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 opt-in gate and additional validation on external credential input. See the GitHub patch and the MetaCPAN 0.05 to 0.06 diff for full context, along with the Openwall advisory.

Workarounds

Explicitly unset GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES in production environments where pluggable executables are not needed
Restrict filesystem permissions on credential JSON files to prevent tampering by untrusted users or processes
Validate credential JSON structure before loading and reject configurations containing credential_source.executable

bash

# Upgrade Google::Auth via cpanm and verify the resolved version
cpanm Google::Auth@0.06
perl -MGoogle::Auth -e 'print $Google::Auth::VERSION, "\n"'

# Optionally disable pluggable executables at the environment level
unset GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES