by Kastro
Paper/Archive/CVE-2026-86413

CVE-2026-86413

curl curl — Negotiate credentials sent to redirected origin

EPSS 0.3%public exploitCVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 24.9.249 × 205.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

Affected

ProductAffectedFixed inSource
curl8.22.0 – 8.22.0–CNA
curl8.21.0 – 8.21.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcurl.se/docs/CVE-2026-86413.jsonrefcurl.se/docs/CVE-2026-86413.htmlexploithackerone.com/reports/3993549