curl / Docs / curl CVEs / leaking host credentials to HTTP proxy

CVE-2026-86414

leaking host credentials to HTTP proxy

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:.

INFO

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86414 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

Affected versions: curl 7.10.8 to and including 8.22.0
Not affected versions: curl < 7.10.8 and >= 8.23.0
Not affected versions: curl >= 8.20.2 in the 8.20.X branch
Not affected versions: curl >= 8.16.2 in the 8.16.X branch
Not affected versions: curl >= 8.14.3 in the 8.14.X branch
Introduced-in: https://github.com/curl/curl/commit/52ceab5e41a01b4d1227876

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

Fixed-in: https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Avoid HTTP proxies

TIMELINE

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Reported-by: Stanislav Fort (Aisle Research)
Patched-by: Stefan Eissing

Thanks a lot!