Live › vulnerability › CVE-2026-94265
Go to dashboardWhen curl follows an HTTP redirect to a URL containing a username and password, it can keep the original host's HTTP Negotiate authentication state and send it along. A malicious server can use this to make curl send a freshly minted Kerberos ticket, built from the client's ambient identity, to an untrusted third-party host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run curl with Negotiate (Kerberos/SPNEGO) authentication and follow HTTP redirects, especially when the client runs under a user identity with Kerberos tickets and the target server is not fully trusted. Hosts that never use Negotiate auth or do not follow redirects with curl are unlikely to be exposed.
No product ranges from the sources yet.
curl --version and compare against the fixed version in the advisory (unknown in the sources).--negotiate, --anyauth or Kerberos/GSSAPI auth and follow redirects (-L).-L) when using Negotiate auth against untrusted servers.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When processing an HTTP redirect to a URL containing userinfo (a
username:password component), curl might erroneously retain and re-transmit
the original host's HTTP Negotiate authentication state. Consequently, a
malicious server can trigger a redirect containing arbitrary userinfo to force
curl to send a freshly minted Kerberos ticket—generated using the ambient
identity of the client process to an untrusted third-party host, effectively
bypassing the domain-scoping restrictions normally enforced by the absence of
--location-trusted.
This page as .md · .json · in your agent: get_signal("CVE-2026-94265")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.