{"id":"CVE-2026-86413","kind":"vulnerability","aliases":["CVE-2026-86413"],"related":[],"title":"curl: Negotiate credentials forwarded to unrelated origin on redirect","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there.","summary":"When curl uses an ambient user for Negotiate authentication and follows redirects, it can send its credential details to a second, unrelated origin that the redirect points to. An attacker who controls a redirect target can receive those credentials.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","kerberos","libcurl","package","self-hosted"],"not_affected_if":["no-negotiate-auth","no-redirect-following"],"how_to_check":"- Run `curl --version` and compare against the fixed release listed in the advisory, which the sources do not state\n- Look for scripts or services that call curl with `--negotiate` or `--location` against hosts you do not control","fix":"- Upgrade curl to a release that includes the fix for CVE-2026-86413; the exact version is unknown from the sources\n- Until upgraded, avoid combining Negotiate authentication with following redirects to untrusted hosts","status":"open","published_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:35+00:00","updated_at":"2026-10-25T05:04:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade curl to a release that includes the fix for CVE-2026-86413; the exact version is unknown from the sources\n- Until upgraded, avoid combining Negotiate authentication with following redirects to untrusted hosts","reach":"network","title":"curl: Negotiate credentials forwarded to unrelated origin on redirect","impact":"medium","summary":"When curl uses an ambient user for Negotiate authentication and follows redirects, it can send its credential details to a second, unrelated origin that the redirect points to. An attacker who controls a redirect target can receive those credentials.","category":"package","nicknames":[],"who_cares":["curl","libcurl","kerberos","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Negotiate credentials leak to an unrelated attacker-controlled server.","analyst_note":"Confirm the fixed curl version and whether the flaw is default-enabled using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-86413 and the curl project advisory.","how_to_check":"- Run `curl --version` and compare against the fixed release listed in the advisory, which the sources do not state\n- Look for scripts or services that call curl with `--negotiate` or `--location` against hosts you do not control","needs_analyst":true,"not_affected_if":["no-negotiate-auth","no-redirect-following"],"who_is_affected":"Systems that run curl or libcurl with Negotiate (Kerberos/SPNEGO) authentication and redirect following enabled, using an ambient user identity, are exposed. Scripts or services that never use Negotiate auth or never follow redirects can likely skip it, but the sources do not confirm the exact default-config behavior.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3275,"output_tokens":640,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-86413':12A,15A 'ambient':27B,65C 'ask':75C,92C 'attack':52B 'authent':31B,73C 'control':54B 'could':80C 'credenti':3A,39B,61B,84C 'curl':1A,16B,24B,79C 'cve':10A,13A 'detail':40B,85C 'first':69C 'follow':33B,77C 'forward':4A 'host':22B 'kerbero':17B 'libcurl':18B 'negoti':2A,30B,72C 'origin':7A,45B,90C 'packag':19B 'pass':81C 'point':49B 'receiv':59B 'redirect':9A,34B,48B,56B,78C,94C 'second':43B,89C 'self':21B 'self-host':20B 'send':37B 'target':57B 'transfer':70C 'unrel':6A,44B,88C 'use':25B,63C 'user':28B,66C","nicknames":[],"mitigations":[],"who_affected":"Systems that run curl or libcurl with Negotiate (Kerberos/SPNEGO) authentication and redirect following enabled, using an ambient user identity, are exposed. Scripts or services that never use Negotiate auth or never follow redirects can likely skip it, but the sources do not confirm the exact default-config behavior.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","severity":null,"published_at":"2026-10-20T20:17:25+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}