by Kastro
Paper/Archive/CVE-2026-8926

CVE-2026-8926

curl curl — password leak with netrc and user in URL

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 38.6.386 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://[email protected]/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

Affected

ProductAffectedFixed inSource
curl8.11.1 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curle9b9bbac22c26cf67316fa8e6c6b9e831af31949 – < 4ae1d7cc2643e4773a136395f12bc02fc68678544ae1d7cc2643e4773a136395f12bc02fc6867854CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA
curl8.14.1–CNA
curl8.14.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refcurl.se/docs/CVE-2026-8926.jsonrefcurl.se/docs/CVE-2026-8926.htmlexploithackerone.com/reports/3735184