Curl HTTP Redirect Userinfo Leak: Kerberos Ticket Bypass
CVE-2026-94265 Published on October 20, 2026

Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticketgenerated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.

NVD

Vulnerability Analysis

CVE-2026-94265 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2026-94265 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2026-94265

Want to know whenever a new CVE is published for Haxx Curl? stack.watch will email you.

Haxx Curl
 

Affected Versions

curl: