curl / Docs / curl CVEs / Negotiate credentials sent to redirected origin
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-86413

Negotiate credentials sent to redirected origin

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

INFO

ambient user is the term used for when curl itself does not actually know the credentials, but curl has been instructed to pass on what the kerberos system provides it. This is accomplished by providing a blank username to curl.

To trigger this flaw, the redirect needs to be done to a URL with user authentication details (name and password) like https://user:pass@evil.example/. This is a rare style, unless done on purpose.

This bug also does not trigger if curl was told to disallow usernames in URLs.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86413 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Do not a ambient user with redirects

TIMELINE

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!