Live › vulnerability › CVE-2026-86410
Go to dashboardThe curl command line tool only applies SSH host verification options when a user directly requests an SFTP or SCP URL, not when the transfer is reached by following a redirect. An attacker who can redirect curl to an SSH server may get connections that skip the intended host key checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run the curl command line tool to fetch sftp:// or scp:// URLs, especially in scripts that follow redirects and rely on SSH host key pinning for security. Applications that only use libcurl over HTTP or HTTPS, or that never use SFTP or SCP, are unlikely to be affected; the sources do not say more.
No product ranges from the sources yet.
curl --version and compare the curl version against the fixed release in the sources, which the sources do not state: unknown-L or --location together with SFTP or SCP URLs, or with SSH host key options such as --hostpubsha256, --hostpubmd5 or --known-hosts-L) when fetching sftp:// or scp:// URLsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
This page as .md · .json · in your agent: get_signal("CVE-2026-86410")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.