curl CVE-2026-86410

Exploitation requires a specific, non-default curl invocation: the user must pass --location (follow redirects) together with --proto-redir +sftp and have supplied SSH host-verification options (--knownhosts, --hostpubsha256, or --hostpubmd5), and the initial URL must be HTTPS. The attacker must additionally control or tamper with the HTTPS server so it returns a 'Location: sftp://...' redirect, and must be positioned as an in-path/man-in-the-middle to impersonate the SSH host for the bypass to be meaningful. Limiting factors: this flag combination is uncommon and opt-in (not default behavior), the attack needs attacker influence over the HTTPS response plus a MITM position on the SFTP connection, and the bug only degrades a security control the user deliberately requested rather than opening direct code execution or data access by itself.

This is a logic flaw in the curl command-line tool where SSH host-key verification options (--knownhosts, --hostpubsha256, --hostpubmd5) are silently not applied when an SFTP/SCP connection is reached via an HTTPS redirect rather than directly. Key prioritization signals are largely absent: no CVSS vector, no CWE, no EPSS score, no POC, and the vulnerability is NOT on the CISA KEV list (no public exploit identified at time of analysis). Exploitation is narrowly gated: the victim must explicitly invoke a non-default and uncommon flag combination (--location together with --proto-redir +sftp), the attacker must control or tamper with the HTTPS server to emit a 'Location: sftp://' redirect, and the attacker must additionally be positioned to intercept or impersonate the SSH endpoint for the bypass to yield real value (a man-in-the-middle). Despite curl being ubiquitously deployed, the combination of a rare opt-in configuration and the need for an active MITM position makes this a medium/low real-world risk rather than a mass-exploitation priority - it is a defense-in-depth bypass against users who deliberately asked for strict host verification. CVSS, CWE, EPSS, KEV and POC data are all MISSING from the input; the only confirmed external signal is that Ubuntu shipped a patch (USN-8927-1), so severity here is inferred from the description, not vendor-scored.

A user runs curl against an HTTPS URL with --location --proto-redir +sftp and their own SSH host-verification flags set, expecting those checks to protect the eventual SFTP transfer. An attacker who controls or can tamper with the HTTPS response returns a 'Location: sftp://evil.example.com' redirect; curl follows it and opens the SFTP session with no host verification, allowing an in-path attacker to impersonate the SSH server and intercept or alter the transferred data. No public exploit code is identified at time of analysis.