Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to use Negotiate auth
-
DeliveryServer redirects or references foreign origin
-
Exploitcurl reattaches Negotiate header cross-origin
-
ExecutionAttacker endpoint captures SPNEGO token
-
ImpactCredential/token exposure
Vulnerability Assessment
| Exploitation Conditions | Requires curl/libcurl to be invoked with HTTP Negotiate (SPNEGO/Kerberos) authentication enabled (e.g. --negotiate / CURLAUTH_NEGOTIATE) and a request flow that reaches a foreign origin (such as a server-controlled redirect or cross-origin transition) to which curl erroneously sends the 'Authorization: Negotiate' header. Exploitation is LIMITED to versions 8.21.0 through 8.22.0, only affects users who actually use Negotiate auth (a non-default, enterprise/Kerberos-specific configuration), and yields only token/credential disclosure - not code execution or service disruption. Default curl usage without Negotiate authentication is unaffected. |
| Impact | This is a genuinely low-priority issue, consistent with the curl project's own LOW severity rating. No CVSS vector, EPSS score, KEV listing, or POC is present in the provided data, so exploitation probability cannot be quantified and there is no evidence of active exploitation or published exploit code. The flaw is a credential-exposure bug: curl sends the 'Authorization: Negotiate' header (an SPNEGO/Kerberos token) to a foreign origin it should not, meaning value is realized only when a user actively uses Negotiate authentication AND interacts with an attacker-influenced redirect or foreign origin. Impact is confined to confidentiality (leak of a Negotiate token), with no integrity or availability effect. The narrow affected range (introduced in 8.21.0, last affected 8.22.0, fixed in 8.23.0) further limits exposure to very recent curl builds. Note: no vendor CVSS was supplied, so the vector below is independently assessed and should be verified against the curl advisory at curl.se/docs/security.html. |
| Exploit ScenarioDerived | A user runs curl with Negotiate/SPNEGO authentication enabled against a server that redirects to, or is otherwise treated as, a foreign origin. curl improperly attaches the 'Authorization: Negotiate' credential to the request toward that foreign origin, allowing the attacker-controlled endpoint to capture the Kerberos/SPNEGO token. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Credential leakage in curl 8.21.0 through 8.22.0 allows unauthenticated remote attackers to obtain Negotiate (SPNEGO/Kerberos) authentication tokens when a redirect or cross-origin transition causes the 'Authorization: Negotiate' header to be sent to a foreign origin. The flaw is rated LOW by the curl project and has an assessed CVSS 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N; no public exploit code was identified at time of analysis. Exploitation requires the user to explicitly enable Negotiate authentication (e.g., via --negotiate or CURLAUTH_NEGOTIATE) and for the request flow to reach a foreign origin, limiting impact to token disclosure rather than code execution or service disruption.
RemediationAI
Vendor-released patch: curl 8.23.0. Upgrade to curl 8.23.0 or later. The official advisory is at https://curl.se/docs/security.html. If immediate upgrade is not possible, disable Negotiate authentication by avoiding --negotiate and CURLAUTH_NEGOTIATE; this eliminates the risk but breaks Kerberos/SPNEGO functionality and may affect enterprise environments that rely on integrated authentication. As a secondary measure, restrict curl usage to trusted origins and avoid following redirects to untrusted servers, though this is not foolproof for server-controlled redirects. No vendor workaround other than upgrade or disabling the feature is provided.
Affected ProductsAI
curl and libcurl versions 8.21.0 through 8.22.0 are affected. This includes the curl command-line tool and the libcurl library when used with HTTP Negotiate authentication. The vulnerability was introduced in 8.21.0 and fixed in 8.23.0. No specific CPE strings were provided in the input data. Vendor guidance is available at https://curl.se/docs/security.html and the oss-security advisory at https://seclists.org/oss-sec/2026/q4/154.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
curl supports HTTP Negotiate (SPNEGO/Kerberos) authentication through CURLAUTH_NEGOTIATE or the --negotiate command-line option, which performs a connection-oriented authentication handshake and attaches an 'Authorization: Negotiate' header to requests. The vulnerability arises from a failure to properly scope connection reuse or redirect handling for Negotiate-authenticated connections, causing that header to be transmitted to a foreign origin, such as after a server-controlled redirect or a cross-origin transition. This is a credential exposure flaw that aligns with CWE-200 (Exposure of Sensitive Information) or CWE-522 (Insufficiently Protected Credentials), not a memory-corruption or code-execution issue. Affected versions are 8.21.0 through 8.22.0, and the fix is included in curl 8.23.0. The CWE is not specified in the provided data, but the root cause is improper origin validation for sensitive authentication headers during connection reuse and redirect processing.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-delivered but requires Negotiate auth plus a foreign-origin/redirect condition (AC:H); no local privilege needed (PR:N); only token leakage, so C:L with no integrity or availability impact.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB