How can I get a git submodule's associated commit ID from a past commit in the parent clone?

Is there a way, short of actually checking out the parent commit, to determine a submodule's SHA-1 commit ID based on a commit ID in the parent clone? I know I can find the currently associated SHA-1 with git submodule.

Here's an example:

• I have a clone with a single submodule foo that has changed several times in the last month.
• I have a tag in the parent clone that is a few weeks old called released-1.2.3. I want to find out what the associated SHA-1 of foo was for this tagged commit.
• I could simply check out released-1.2.3 and use git submodule to see, but I'm wondering if there's a way to do this without affecting the working tree, as I want to script it.

I want to do this because I want to construct a script to do a 'diff' on all changes within a submodule between two commits within the parent repository - i.e. "tell me what files changed within the submodule foo between these two commits in the parent."