Skip to main content

curl CVE-2026-8926

| EUVDEUVD-2026-41507 CRITICAL
Insufficiently Protected Credentials (CWE-522)
2026-06-24 GHSA-vw2x-3w8j-rq82
Information Disclosure Curl Haxx
Critical
Disputed · 9.1 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Operator uses .netrc with bare-username URL
  2. Delivery
    curl finds no matching login
  3. Exploit
    Falls back to another user's password
  4. Execution
    Wrong credential sent to host
  5. Impact
    Credential exposed to unintended account/server

Vulnerability Assessment

Weakness
CWE
CWE-522
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
Exploitation Conditions

Exploitation requires all of the following concrete conditions: curl or libcurl must be invoked with .netrc lookup enabled (--netrc / --netrc-optional / CURLOPT_NETRC), the target URL must include a username but omit the password (e.g. https://user@example.com/), the .netrc file for that host must NOT contain a matching entry for that username, AND it must contain at least one other credential entry for the same host that curl can wrongly fall back to. Limiting factors: this is not exploitable against default configurations that do not use .netrc, and it does not fire when the named user has a proper .netrc match or when no other host entry exists - so it is an operator/config-dependent credential-leak condition, not remote unauthenticated exploitation of a service.
Impact

Signals conflict on severity. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) rates this Critical, but that appears inflated for a credential-confusion bug: exploitation is not a classic remote attack against a listening service, it requires a specific and non-default combination (an operator using .netrc AND a bare-username URL AND a .netrc that already contains another entry for that host with no match for the named user), which argues for higher attack complexity and no integrity impact. EPSS is low (0.20%, percentile 9%) and the CVE is NOT in CISA KEV, consistent with no widespread automated exploitation. There is no automated network exploit primitive; the realistic outcome is inadvertent leakage of the wrong credential to a host. Net: treat as a real but moderate credential-hygiene issue for environments that script curl with .netrc, not an emergency internet-facing RCE despite the 9.1 label - verify the I:H claim with the vendor advisory.
Exploit ScenarioDerived

An automation host runs scripts that call curl with .netrc enabled and URLs of the form https://svc-user@internal-api/. Because svc-user has no .netrc entry but another account for that host does, curl attaches that other account's password to the request, so a server operator (or an attacker who controls or impersonates the host) captures a credential that was never meant for that login. Attack complexity is elevated because it depends on the specific .netrc/URL mismatch rather than a directly attacker-triggered flaw; details are documented in the public HackerOne report.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. Publicly available exploit-flow details exist via the originating HackerOne report; EPSS is low (0.20%, 9th percentile) and it is not in CISA KEV.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:28 cvss changed CVSS 9.1

Credential leakage in curl 8.11.1 through 8.20.0 allows the password belonging to a different account to be silently transmitted when curl consults a .netrc file and is given a URL containing only a username (e.g. https://user@example.com/). When no .netrc entry matches the requested user but another entry exists for the same host, curl pairs the specified username with the wrong user's password and sends it to the server, exposing a secret to an unintended recipient. No public exploit identified at time of analysis; EPSS is low (0.20%, 9th percentile) and it is not listed in CISA KEV, consistent with an information-disclosure defect rather than a mass-exploited RCE.

v1 Jun 24, 2026 - 18:28

Password leakage in curl/libcurl occurs when credentials stored in a .netrc file interact with a user-specified username embedded directly in a URL, causing the password to be exposed outside its intended scope. Affected are curl versions up to and including 8.20.0; curl 8.21.0 released June 24, 2026 resolves this issue. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its LOW severity classification by the curl project.

RemediationAI

Patch available per vendor advisory: upgrade to the fixed curl/libcurl release listed at https://curl.se/docs/CVE-2026-8926.html and apply distribution updates such as Ubuntu USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1); the exact fixed version number was not present in the supplied data, so confirm it against the curl advisory before deployment rather than assuming a version. As an immediate compensating control, avoid combining --netrc/--netrc-optional with URLs that embed a username but no password - either specify the full user:password explicitly, or ensure .netrc contains a matching login entry for every username you pass so no silent fallback can occur; the trade-off is added credential-management overhead in scripts. Where feasible, scope .netrc to a single login per host or use per-host credential files to eliminate the mismatched-entry condition entirely.

Affected VersionsENISA

curl 8.15.0 ≤8.15.0
curl 8.13.0 ≤8.13.0
curl 8.11.1 ≤8.11.1
curl 8.14.0 ≤8.14.0
curl 8.17.0 ≤8.17.0
curl 8.20.0 ≤8.20.0
curl 8.12.0 ≤8.12.0
curl 8.14.1 ≤8.14.1
curl 8.12.1 ≤8.12.1
curl 8.19.0 ≤8.19.0
curl 8.16.0 ≤8.16.0
curl 8.18.0 ≤8.18.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in curl's .netrc credential-resolution logic (the netrc parser used by libcurl and the curl command-line tool). A .netrc file maps machine/login/password triples per host; when a URL supplies a username without a password, curl is supposed to find the password for that exact login. The bug is a matching failure: instead of requiring the login to match, curl accepts an unrelated password entry for the same host when the requested user is absent. The root-cause class is CWE-287/CWE-522-style credential mismanagement (use of wrong/incorrect credentials); NVD lists CWE as N/A. This is a logic error in credential selection rather than a memory-safety issue.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 5.9 MEDIUM

AC:H because it needs a specific .netrc-plus-bare-username mismatch; PR:N/UI:N as no target auth is needed; C:H for credential leak; I:N and A:N since no data is altered or blocked.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 4.8 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Updated
Jul 06, 2026 - 18:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:28 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

curl versions 8.11.1 through 8.20.0 contain a critical credential disclosure vulnerability that can leak stored credentials when processing URLs with embedded usernames. Organizations using curl with .netrc-based authentication risk having one user's credentials transmitted to a different account on the same hostname. Publicly available exploit code exists but has not been actively exploited, and exploitation requires specific .netrc configuration.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Prevalence
Ubiquitous
curl/libcurl ships in nearly every OS, container, and CI toolchain
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2021-30116 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8926 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376072 REF https://curl.se/docs/CVE-2026-8926.html REF https://curl.se/docs/CVE-2026-8926.json REF https://hackerone.com/reports/3735184

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy