Skip to main content

curl CVE-2026-8926

| EUVDEUVD-2026-41507 CRITICAL
Insufficiently Protected Credentials (CWE-522)
2026-06-24 GHSA-vw2x-3w8j-rq82
Information Disclosure Curl
Critical
Disputed · 9.1 Vendor
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
5.9 MEDIUM

AC:H because it needs a specific .netrc-plus-bare-username mismatch; PR:N/UI:N as no target auth is needed; C:H for credential leak; I:N and A:N since no data is altered or blocked.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 06, 2026 - 18:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 06, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)
Analysis Generated
Jun 24, 2026 - 18:28 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Operator uses .netrc with bare-username URL
Delivery
curl finds no matching login
Exploit
Falls back to another user's password
Execution
Wrong credential sent to host
Impact
Credential exposed to unintended account/server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following concrete conditions: curl or libcurl must be invoked with .netrc lookup enabled (--netrc / --netrc-optional / CURLOPT_NETRC), the target URL must include a username but omit the password (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals conflict on severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An automation host runs scripts that call curl with .netrc enabled and URLs of the form https://svc-user@internal-api/. Because svc-user has no .netrc entry but another account for that host does, curl attaches that other account's password to the request, so a server operator (or an attacker who controls or impersonates the host) captures a credential that was never meant for that login. …
Remediation Patch available per vendor advisory: upgrade to the fixed curl/libcurl release listed at https://curl.se/docs/CVE-2026-8926.html and apply distribution updates such as Ubuntu USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1); the exact fixed version number was not present in the supplied data, so confirm it against the curl advisory before deployment rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Identify all curl deployments and determine which systems run versions 8.11.1 through 8.20.0. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Curl

View all
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
CVE-2023-27533 HIGH POC
8.8 Mar 30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2020-8177 HIGH POC
7.8 Dec 14

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead to

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8
CVE-2017-3192 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-8926 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy