diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
index d2e622ba7c3..5ed1203b2a6 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
@@ -228,9 +228,11 @@ func newCmdTokenSource(cmd string, args []string, tokenKey, expiryKey, timeFmt s
 func (c *commandTokenSource) Token() (*oauth2.Token, error) {
 	fullCmd := strings.Join(append([]string{c.cmd}, c.args...), " ")
 	cmd := execCommand(c.cmd, c.args...)
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
 	output, err := cmd.Output()
 	if err != nil {
-		return nil, fmt.Errorf("error executing access token command %q: err=%v output=%s", fullCmd, err, output)
+		return nil, fmt.Errorf("error executing access token command %q: err=%v output=%s stderr=%s", fullCmd, err, output, string(stderr.Bytes()))
 	}
 	token, err := c.parseTokenCmdOutput(output)
 	if err != nil {