{"id":"CVE-2026-86410","kind":"vulnerability","aliases":["CVE-2026-86410"],"related":[],"title":"curl: SSH host verification skipped when following redirects to SFTP or SCP","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.","summary":"The curl command line tool only applies SSH host verification options when a user directly requests an SFTP or SCP URL, not when the transfer is reached by following a redirect. An attacker who can redirect curl to an SSH server may get connections that skip the intended host key checks.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","package","scp","scripts","self-hosted","sftp"],"not_affected_if":["no-redirect-following","no-sftp-or-scp"],"how_to_check":"- Run `curl --version` and compare the curl version against the fixed release in the sources, which the sources do not state: unknown\n- Check whether scripts use `-L` or `--location` together with SFTP or SCP URLs, or with SSH host key options such as `--hostpubsha256`, `--hostpubmd5` or `--known-hosts`","fix":"- Upgrade curl to a release that includes the fix; the fixed version is unknown from the sources\n- Until patched, avoid following redirects (omit `-L`) when fetching sftp:// or scp:// URLs","status":"open","published_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:37+00:00","updated_at":"2026-10-25T05:04:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade curl to a release that includes the fix; the fixed version is unknown from the sources\n- Until patched, avoid following redirects (omit `-L`) when fetching sftp:// or scp:// URLs","reach":"network","title":"curl: SSH host verification skipped when following redirects to SFTP or SCP","impact":"medium","summary":"The curl command line tool only applies SSH host verification options when a user directly requests an SFTP or SCP URL, not when the transfer is reached by following a redirect. An attacker who can redirect curl to an SSH server may get connections that skip the intended host key checks.","category":"package","nicknames":[],"who_cares":["curl","sftp","scp","self-hosted","scripts"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Connections to an unintended SSH server may bypass host key checks.","analyst_note":"Find the fixed curl version and the exact conditions for exploitation in the curl project advisory or NVD entry for CVE-2026-86410.","how_to_check":"- Run `curl --version` and compare the curl version against the fixed release in the sources, which the sources do not state: unknown\n- Check whether scripts use `-L` or `--location` together with SFTP or SCP URLs, or with SSH host key options such as `--hostpubsha256`, `--hostpubmd5` or `--known-hosts`","needs_analyst":true,"not_affected_if":["no-sftp-or-scp","no-redirect-following"],"who_is_affected":"Systems that run the curl command line tool to fetch sftp:// or scp:// URLs, especially in scripts that follow redirects and rely on SSH host key pinning for security. Applications that only use libcurl over HTTP or HTTPS, or that never use SFTP or SCP, are unlikely to be affected; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000662,"input_tokens":3261,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86410':15A,18A 'appli':33B 'attack':59B 'check':77B 'command':29B,83C 'connect':70B 'curl':1A,19B,28B,63B,82C 'cve':13A,16A 'direct':41B,98C 'flaw':79C 'follow':7A,55B,109C 'get':69B 'host':3A,25B,35B,75B,93C 'intend':74B 'interact':97C 'key':76B 'line':30B,84C 'logic':87C 'make':88C 'may':68B 'option':37B,95C 'packag':20B 'reach':53B 'redirect':8A,57B,62B,111C 'request':42B 'result':107C 'scp':12A,21B,46B,102C 'script':22B 'self':24B 'self-host':23B 'server':67B 'set':91C 'sftp':10A,26B,44B,100C 'skip':5A,72B 'ssh':2A,34B,66B,92C 'tool':31B,85C 'transfer':51B 'url':47B 'use':99C 'user':40B 'verif':4A,36B,94C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the curl command line tool to fetch sftp:// or scp:// URLs, especially in scripts that follow redirects and rely on SSH host key pinning for security. Applications that only use libcurl over HTTP or HTTPS, or that never use SFTP or SCP, are unlikely to be affected; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","severity":null,"published_at":"2026-10-20T20:17:25+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}