curl CVE-2026-12064

Exploitation requires all of: (1) the victim invoking curl with a schemeless URL combined with '--proto-default sftp' or '--proto-default scp' (equivalently CURLOPT_DEFAULT_PROTOCOL set to sftp/scp) - this exact non-default invocation is the trigger; (2) an active man-in-the-middle position on the SSH connection path to impersonate the SFTP/SCP server; and (3) the victim using SFTP/SCP transfers at all. Limiting factors that reduce real-world risk: it does NOT trigger when an explicit scheme is present in the URL, it requires network interception rather than mere reachability, and it depends on a specific command-line usage pattern that is not curl's default behavior. The CVSS vector is PR:N (no attacker authentication), but the practical barrier is the MITM position plus the specific victim configuration.

Signals are mixed and point to a real-but-conditional integrity risk rather than a mass-exploitation emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:N, score 7.5) treats it as network, low-complexity, unauthenticated with high integrity impact, but this understates two limiting factors: a successful attack requires an active man-in-the-middle position on the SSH path AND a victim running a non-default invocation (schemeless URL with --proto-default sftp/scp), which in practice argues for higher attack complexity than AC:L. EPSS is low (0.21%, 11th percentile), consistent with the narrow preconditions, and there is no KEV listing and no public exploit identified, so there is no evidence of active or widespread exploitation. NVD scores no confidentiality/availability impact, though a MITM who defeats host verification can typically read transferred data too, so C:N is arguably conservative. Net: prioritize for environments that script curl SFTP/SCP transfers with default-protocol flags, but this is not a drop-everything issue for the general population.

An attacker positioned on the network path (e.g. rogue Wi-Fi, ARP/DNS spoofing, or a compromised upstream hop) waits for a script or user that runs 'curl --proto-default sftp user@host/path' with a schemeless target. Because curl skips host-key verification for this invocation, the attacker's spoofed SSH server is accepted without a mismatch error, letting them intercept credentials/data or serve tampered files. No public exploit is identified at time of analysis, and the attack requires the MITM position plus the specific default-protocol invocation.