curl Credential Inference via .netrc/Username Mismatch
CVE-2026-8926 Published on July 3, 2026

password leak with netrc and user in URL
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

NVD


Products Associated with CVE-2026-8926

stack.watch emails you whenever new vulnerabilities are published in Canonical Ubuntu Linux or Haxx Curl. Just hit a watch button to start following.

Canonical Ubuntu Linux
 
Haxx Curl
 

Affected Versions

curl: