Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition as/compromise HTTP proxy
-
ExploitVictim curl configured with host credentials
-
ExecutionCredentials mis-sent to proxy
-
ImpactHarvest leaked host credentials
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires curl/libcurl to be configured to use an HTTP proxy AND to be supplied with credentials intended for the origin host; under this combination curl leaks those host credentials to the HTTP proxy rather than reserving them for the origin server. The practical limiting factors are significant: an attacker must operate, compromise, or otherwise observe the HTTP proxy to capture the leaked credentials, the proxy-plus-credentials configuration must actually be in use (it does not affect the common direct-connection or no-credential cases), and the deployment must run an affected version at or below 8.22.0. |
| Impact | This is a LOW-severity information-disclosure flaw as rated by the curl project itself, and the supporting signals reinforce that low real-world urgency rather than contradicting it. No CVSS vector, EPSS score, KEV listing, POC, or SSVC data was provided in the input, so there is no evidence of active exploitation or automatable mass abuse - exploitation status is therefore 'no public exploit identified at time of analysis.' The offsetting factor is prevalence: curl/libcurl is one of the most widely deployed pieces of software in existence (the vendor claims over twenty billion installations), so even a minor credential-leak bug has an enormous installed base. However, the bug only matters in the specific configuration where an HTTP proxy is used together with host/origin credentials, which sharply narrows the realistically exploitable population and keeps real-world risk low. Net: patch via normal maintenance cycles (upgrade to curl 8.23.0); this is not an emergency despite the ubiquity of curl. Note the key data gap - no official CVSS vector is published in the input, so authentication/attack-complexity claims below are inferred from the description, not confirmed by NVD. |
| Exploit ScenarioDerived | An organization runs curl/libcurl configured to route traffic through an HTTP proxy while also supplying credentials intended for the origin host. Due to this flaw, curl discloses those host credentials to the HTTP proxy instead of keeping them for the origin, so an attacker who operates or has compromised the intermediary proxy passively harvests credentials that were never meant for it. No public exploit code is identified; exploitation requires the attacker to control or observe the proxy path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Credential disclosure in curl and libcurl at or below 8.22.0 causes origin host credentials to be sent to a configured HTTP proxy instead of being reserved for the intended origin server. The flaw only manifests when a deployment both routes transfers through an HTTP proxy and supplies credentials intended for the origin host, which is why the curl project rates it LOW severity and why the independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - confidentiality-only impact with high attack complexity and no integrity or availability effect. There is no KEV listing and no public exploit identified at time of analysis, so real-world urgency is driven mainly by whether an environment uses untrusted or shared proxies alongside origin credentials. The fix ships in curl 8.23.0.
RemediationAI
Vendor-released patch: curl 8.23.0. Upgrade curl and every embedded libcurl copy to 8.23.0 or later - since libcurl is statically or dynamically linked into many applications, routers, appliances, and language runtimes, inventory and rebuild dependent software rather than patching only the standalone curl binary. Organizations running Rock-solid curl LTS branches can obtain the backported security fix through their support contract (https://rock-solid.curl.dev). If upgrading is not immediately possible, the specific compensating control that maps to this flaw is to stop supplying origin credentials on transfers that traverse an HTTP proxy: avoid -u/CURLOPT_USERPWD and equivalent credential options in proxy-routed contexts, use --noproxy '*' or a direct connection path for credential-bearing requests, and never send origin credentials through a proxy you do not fully trust or control - the trade-off is that this breaks authenticated access through corporate egress proxies. Restricting proxied traffic to trusted, dedicated proxies and monitoring proxy logs for unexpected Authorization headers reduces exposure but is detective rather than preventive. Treat any credential that may have traversed an untrusted proxy on an affected version as compromised and rotate it. Confirm the state of any affected deployment against the full advisory set at https://curl.se/docs/security.html and https://seclists.org/oss-sec/2026/q4/154 before assuming a single component upgrade resolves the whole batch.
Affected ProductsAI
The affected software is curl and libcurl, including the curl command-line tool and the embeddable libcurl library that ships in operating systems, appliances, and countless third-party applications. Per the curl security advisory batch accompanying the 8.23.0 release, all affected versions up to and including 8.22.0 are vulnerable, with the fix landing in curl 8.23.0; the exact first-vulnerable version for CVE-2026-86414 was truncated in the supplied vulnerability table, although sibling advisories published on the same date list first-vulnerable versions spanning 7.15.0 through 8.21.0, indicating this defect has existed in libcurl for a long time. No CPE identifiers were included in the input data. Vendor advisory material is available at https://curl.se/docs/security.html and the oss-security post at https://seclists.org/oss-sec/2026/q4/154, with commercial long-term-support coverage described at https://rock-solid.curl.dev.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This issue sits in libcurl's connection and credential handling layer - the same code path responsible for deciding which authentication material is attached to a connection when a transfer is routed through a proxy. Because libcurl pools and reuses connections, the binding between a connection and the credential context it belongs to must be maintained carefully; CVE-2026-86414 is one of several flaws in the curl 8.23.0 batch (alongside CVE-2026-86415 auto client cert connection reuse mixup, CVE-2026-86413/94265 Negotiate credentials sent to redirected origin, CVE-2026-86411 FTP connection reuse inheriting client-certificate, and CVE-2026-87861 cross-origin reuse of a Negotiate connection) that all stem from the same general weakness class: insufficient isolation of credentials across connection contexts. No CWE identifier was supplied in the input data and no CVSS vector was published by the vendor, but the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N confirms a network-reachable, unauthenticated information-disclosure primitive in which the leaked secret is the credential material itself. The attack requires an adversary who can operate, compromise, or observe the HTTP proxy that receives the leaked credentials; the curl library alone does not hand the credentials to an attacker - a hostile or monitored proxy completes the chain. No CPE strings were provided, so affected identity is established from the curl vulnerability table and release mapping rather than from CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-reachable but AC:H because it requires the specific proxy-plus-host-credentials configuration and an attacker on the proxy path; only confidentiality is affected (C:L), with no integrity or availability impact.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB