curl / Docs / curl CVEs / redirect to SFTP or SCP bypasses host verification
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-86410

redirect to SFTP or SCP bypasses host verification

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

INFO

This means --knownhosts, --hostpubsha256, and --hostpubmd5 are never installed when the initial URL is HTTPS. If --location and --proto-redir +sftp is used and the server returns a Location: sftp://example.com redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods. It should be noted that following and allowing redirects to SFTP or SCP is rare.

This problem is similar, but not identical, to CVE-2026-12064.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86410 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Low

AFFECTED VERSIONS

curl is used by many applications, but not always advertised as such!

This flaw is only affecting the curl command line tool, not libcurl.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Do not allow redirects to SFTP or SCP

TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!