curl / Docs / curl CVEs / cross-origin reuse of a Negotiate connection

CVE-2026-87861

cross-origin reuse of a Negotiate connection

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

INFO

An ambient user means that a blank username is provided and the real identity and credentials are handled under curl's radar.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87861 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

Affected versions: curl 8.21.0 to and including 8.22.0
Not affected versions: curl < 8.21.0 and >= 8.23.0
Introduced-in: https://github.com/curl/curl/commit/bd10924b47c8bf94127eaee

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

Fixed-in: https://github.com/curl/curl/commit/7c11f1a1bd53e2cd983fe153e4599

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Avoid using ambient users for authentication

TIMELINE

This issue was reported to the curl project on August 26, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Reported-by: Axel Mierczuk
Patched-by: Stefan Eissing

Thanks a lot!