Live › vulnerability › CVE-2026-86413
Go to dashboardWhen curl uses an ambient user for Negotiate authentication and follows redirects, it can send its credential details to a second, unrelated origin that the redirect points to. An attacker who controls a redirect target can receive those credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run curl or libcurl with Negotiate (Kerberos/SPNEGO) authentication and redirect following enabled, using an ambient user identity, are exposed. Scripts or services that never use Negotiate auth or never follow redirects can likely skip it, but the sources do not confirm the exact default-config behavior.
No product ranges from the sources yet.
curl --version and compare against the fixed release listed in the advisory, which the sources do not state--negotiate or --location against hosts you do not controlEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
This page as .md · .json · in your agent: get_signal("CVE-2026-86413")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.