CVE-2026-94266
password leak in CURLINFO_EFFECTIVE_URL
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
libcurl could accidentally return a URL for curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
INFO
The curl tool exposes the same information using the command line option:
--write-out '%{url_effective}'This credential leak can happen when curl retrieves credentials from a .netrc file.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-94266 to this issue.
CWE-522: Insufficiently Protected Credentials
Severity: low
This bug is not considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS
- Affected versions: curl 7.62.0 to and including 8.22.0
- Not affected versions: curl < 7.62.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/46e164069d1a5230e4e64
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Do not use CURLINFO_EFFECTIVE_URL.
TIMELINE
This issue was reported to the curl project on September 18, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!