Live › vulnerability › CVE-2026-86414
Go to dashboardA malicious HTTP proxy can answer a CONNECT tunnel request with a 401 WWW-Authenticate challenge instead of 407, which tricks libcurl into sending the origin server's credentials to the proxy. An attacker running or controlling a proxy can capture Basic passwords or Negotiate/Kerberos tickets meant for the origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl to reach HTTPS or other origins through an HTTP proxy and send credentials to the origin, such as Basic auth or Negotiate/Kerberos. Exposure depends on the proxy path being untrusted or attacker-controlled. Teams that never use a proxy, or that send no origin credentials, can likely skip it. The sources do not list affected versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the CONNECT tunnel request with 401 WWW-Authenticate: instead of the
expected 407 Proxy-Authenticate:.
This page as .md · .json · in your agent: get_signal("CVE-2026-86414")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.