{"id":"CVE-2026-86414","kind":"vulnerability","aliases":["CVE-2026-86414"],"related":[],"title":"libcurl: malicious proxy can harvest origin credentials via CONNECT 401","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.","summary":"A malicious HTTP proxy can answer a CONNECT tunnel request with a 401 WWW-Authenticate challenge instead of 407, which tricks libcurl into sending the origin server's credentials to the proxy. An attacker running or controlling a proxy can capture Basic passwords or Negotiate/Kerberos tickets meant for the origin.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","kerberos","libcurl","package","proxy"],"not_affected_if":["no-origin-credentials","no-proxy"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:31+00:00","updated_at":"2026-10-25T05:04:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"libcurl: malicious proxy can harvest origin credentials via CONNECT 401","impact":"high","summary":"A malicious HTTP proxy can answer a CONNECT tunnel request with a 401 WWW-Authenticate challenge instead of 407, which tricks libcurl into sending the origin server's credentials to the proxy. An attacker running or controlling a proxy can capture Basic passwords or Negotiate/Kerberos tickets meant for the origin.","category":"package","nicknames":[],"who_cares":["libcurl","c","proxy","kerberos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker captures origin credentials or Kerberos tickets via the proxy","analyst_note":"Find affected and fixed libcurl versions and the upstream fix commit or advisory at curl.se, since the NVD entry gives no version data.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-proxy","no-origin-credentials"],"who_is_affected":"Applications that use libcurl to reach HTTPS or other origins through an HTTP proxy and send credentials to the origin, such as Basic auth or Negotiate/Kerberos. Exposure depends on the proxy path being untrusted or attacker-controlled. Teams that never use a proxy, or that send no origin credentials, can likely skip it. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3331,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86414':13A,16A '401':10A,34B,102C '407':41B,110C 'answer':27B,96C 'attack':56B 'authent':37B,105C,113C 'basic':64B,85C 'c':17B 'captur':63B 'challeng':38B 'connect':9A,29B,98C 'control':59B 'credenti':7A,51B,84C 'cve':11A,14A 'expect':109C 'harvest':5A 'http':24B,74C 'instead':39B,106C 'kerbero':18B 'libcurl':1A,19B,44B,78C 'malici':2A,23B 'meant':69B 'negotiate/kerberos':67B,89C 'origin':6A,48B,72B,82C 'packag':20B 'password':65B,86C 'proxi':3A,21B,25B,54B,61B,75C,93C,112C 'proxy-authent':111C 'request':31B,100C 'run':57B 'send':46B,80C 'server':49B 'ticket':68B,90C 'trick':43B,77C 'tunnel':30B,99C 'via':8A 'www':36B,104C 'www-authent':35B,103C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl to reach HTTPS or other origins through an HTTP proxy and send credentials to the origin, such as Basic auth or Negotiate/Kerberos. Exposure depends on the proxy path being untrusted or attacker-controlled. Teams that never use a proxy, or that send no origin credentials, can likely skip it. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}