Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessClient authenticates to origin A via Negotiate
-
DeliveryApp issues request to foreign origin B
-
Exploitlibcurl reuses A's authenticated connection
-
ExecutionNegotiate-authenticated context reaches B
-
ImpactUnauthorized access/credential exposure at B
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires that libcurl be built and used with Negotiate/SPNEGO (GSSAPI/Kerberos) HTTP authentication AND that the same libcurl handle or connection cache be used to reach more than one origin so that connection reuse can select a connection authenticated to a different host. Limiting factors: the flaw does not apply to deployments that do not use Negotiate auth, that use a single origin per handle, or that disable connection reuse; there is no memory-corruption or code-execution impact, only improper extension of an authenticated connection across origins. This is a client-side/application-dependent condition, not a remotely-triggerable flaw against a default curl configuration, which aligns with the maintainers' LOW rating. |
| Impact | No CVSS vector, EPSS score, KEV listing, or POC is provided in the input (all show N/A), so quantitative exploitation signals are entirely absent and this assessment rests on the curl project's own advisory. The curl maintainers explicitly rate CVE-2026-87861 as severity LOW - the lowest of their four-tier scale - distinguishing it sharply from the single HIGH item (CVE-2026-92392 HTTP/2 UAF) in the same 8.23.0 batch of twenty-four fixes. This is a connection-reuse logic flaw: a libcurl connection already authenticated to one origin via Negotiate (SPNEGO/Kerberos/GSSAPI) can be incorrectly reused for a request to a different origin, meaning the authenticated channel/credentials context is extended to an unintended host. Despite curl's ubiquitous footprint, this is NOT a drop-everything priority: it is a confidentiality-leaning information/authorization boundary issue, not remote code execution, and it only manifests under a narrow combination of conditions (Negotiate auth in use, the same libcurl handle issuing requests to multiple origins, and connection reuse being triggered). There are no conflicting signals to reconcile because no machine-readable scoring data was supplied; the main caveat is that the absence of CVSS/EPSS/KEV here reflects missing input data, not a verified determination of low real-world risk. Treat as a routine security-update item - patch during normal maintenance by upgrading to curl/libcurl 8.23.0. |
| Exploit ScenarioDerived | An application uses libcurl with Negotiate (Kerberos/SPNEGO) authentication and, over the same handle/connection pool, issues requests to more than one host. libcurl reuses a connection that was authenticated for origin A to service a request destined for origin B, so origin B transparently inherits the authenticated channel and may receive access or credential context it should never have. No public exploit code is identified at time of analysis, and triggering requires attacker influence over or control of the second (foreign) origin plus the specific multi-origin reuse pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Cross-origin reuse of a Negotiate-authenticated connection in curl and libcurl (through 8.22.0) allows a connection authenticated to one origin to be reused for a request to a different origin when a single easy handle or connection cache serves multiple hosts. The curl project rates the issue LOW, and the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N shows no privileges required (PR:N) but a high attack complexity, with only a low-confidentiality impact and no integrity or availability effect - there is no memory corruption or code-execution component. Exploitation is conditional on the consuming application being built with Negotiate/SPNEGO (GSSAPI/Kerberos) support and deliberately reusing connections across more than one origin, so it is not a remotely triggerable flaw against a default curl configuration; no public exploit code or CISA KEV entry is identified at time of analysis, and no EPSS score was provided in the available data.
RemediationAI
Vendor-released patch: upgrade to curl 8.23.0 (or later), which contains the fix for CVE-2026-87861 together with the other twenty-three issues in the batch; the advisory text links each flaw to its fixing commit, and details are at https://curl.se/docs/security.html and https://seclists.org/oss-sec/2026/q4/154. If an immediate upgrade is not possible, the practical compensating controls target the precondition rather than the code: keep Negotiate/SPNEGO authentication within a single origin per easy handle and avoid sharing one handle or connection cache across multiple origins, which removes the cross-origin reuse path entirely at the cost of extra TLS/authentication handshakes and higher latency and CPU use; alternatively force fresh connections (CURLOPT_FRESH_CONNECT) or prohibit reuse (CURLOPT_FORBID_REUSE) on any handle that talks to more than one host, at the same performance cost; or, where Negotiate is not actually required, stop enabling CURLAUTH_NEGOTIATE (or build curl without GSSAPI/Kerberos support), which eliminates the exposure but breaks Kerberos/SSO authentication for those clients. Operators who cannot track upstream releases may consider the commercial Rock-solid curl long-term-support branch (https://rock-solid.curl.dev), which backports security fixes to LTS release lines but is available only to customers with support contracts. Note that this is a low-severity, application-dependent credential-scoping issue with no code-execution impact, so remediation should be scheduled rather than treated as an emergency; no vendor-released patch beyond 8.23.0 and no CPE-scoped workaround are documented in the supplied data.
Affected ProductsAI
The issue affects curl and libcurl, with 8.22.0 listed as the last affected release in the curl vulnerability table for the 8.23.0 advisory batch; the fix ships in curl 8.23.0. The provided excerpt of the curl CVE table does not state the first affected version for CVE-2026-87861 specifically, so the full lower version bound should be confirmed against https://curl.se/docs/security.html. Because libcurl is consumed as a library, downstream integrators - applications linking libcurl, language bindings, and appliances or software embedding it - are affected wherever they use Negotiate/SPNEGO HTTP authentication and share a handle or connection cache across multiple origins. No CPE strings were supplied in the input data, so exact product/version matching must be derived from the vendor table rather than from CPE identifiers. Refer to the vendor advisories at https://curl.se/docs/security.html and the oss-security announcement at https://seclists.org/oss-sec/2026/q4/154 for the authoritative affected-version list.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This flaw lives in libcurl's HTTP authentication and connection-reuse logic. Negotiate (SPNEGO over GSSAPI, typically Kerberos) authenticates a connection rather than an individual request: once libcurl completes a Negotiate handshake to an origin, the resulting authenticated connection is a reusable resource. When the same easy handle or multi handle's connection cache is used to reach a second origin, the selection logic can hand back the connection that already carries the authenticated Negotiate state, effectively extending a credential context established for host A to a request aimed at host B. No CWE identifier is supplied in the input data; the defect is best characterized as improper protection of an authentication context across origins rather than a memory-safety class. It belongs to a cluster of related credential-scoping and connection-reuse bugs published together in the 8.23.0 batch - notably CVE-2026-94265 (Authorization: Negotiate sent to foreign origin), CVE-2026-86413 (Negotiate credentials sent to redirected origin), CVE-2026-86415 (auto client-cert connection reuse mixup), CVE-2026-86411 (FTP connection reuse inherits client-certificate) and CVE-2026-86412/CVE-2026-92386 (server-set cookie altering the cookie jar) - which together indicate a systematic audit of what state may be inherited when a connection is reused. Because libcurl is the transfer engine embedded in an enormous range of software, the exposure footprint is far larger than the curl command-line tool alone, but any given deployment is affected only if it combines Negotiate authentication with cross-origin connection reuse.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AC:H because exploitation needs Negotiate auth plus a multi-origin reuse pattern; C:L for leaking an authenticated connection context to a foreign origin, with no integrity or availability impact.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB