cURL Negotiate Auth Redirect Credential Leak
CVE-2026-86413 Published on October 20, 2026
Negotiate credentials sent to redirected origin
When using an *ambient user* in a first transfer doing Negotiate
authentication and asked to follow redirects, curl could pass on its
credential details to an unrelated second origin when asked to redirect there.
Products Associated with CVE-2026-86413
Want to know whenever a new CVE is published for Haxx Curl? stack.watch will email you.
Affected Versions
curl:- Version 8.22.0, <= 8.22.0 is affected.
- Version 8.21.0, <= 8.21.0 is affected.