{"id":"CVE-2026-94265","kind":"vulnerability","aliases":["CVE-2026-94265"],"related":[],"title":"curl: HTTP redirect with userinfo leaks Negotiate Kerberos ticket to third parties","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`.","summary":"When curl follows an HTTP redirect to a URL containing a username and password, it can keep the original host's HTTP Negotiate authentication state and send it along. A malicious server can use this to make curl send a freshly minted Kerberos ticket, built from the client's ambient identity, to an untrusted third-party host.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","kerberos","linux","negotiate-auth","runtime","windows"],"not_affected_if":["no-kerberos-tickets","no-negotiate-auth","no-redirect-following"],"how_to_check":"- Run `curl --version` and compare against the fixed version in the advisory (unknown in the sources).\n- Find scripts or services that call curl with `--negotiate`, `--anyauth` or Kerberos/GSSAPI auth and follow redirects (`-L`).","fix":"- Upgrade curl to a release that includes the fix (the fixed version is unknown in the sources).\n- Until patched, avoid following redirects (`-L`) when using Negotiate auth against untrusted servers.","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:19+00:00","updated_at":"2026-10-25T05:04:19+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:04:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade curl to a release that includes the fix (the fixed version is unknown in the sources).\n- Until patched, avoid following redirects (`-L`) when using Negotiate auth against untrusted servers.","reach":"network","title":"curl: HTTP redirect with userinfo leaks Negotiate Kerberos ticket to third parties","impact":"medium","summary":"When curl follows an HTTP redirect to a URL containing a username and password, it can keep the original host's HTTP Negotiate authentication state and send it along. A malicious server can use this to make curl send a freshly minted Kerberos ticket, built from the client's ambient identity, to an untrusted third-party host.","category":"runtime","nicknames":[],"who_cares":["curl","kerberos","negotiate-auth","linux","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Kerberos ticket for client identity sent to untrusted third-party host.","analyst_note":"Check the NVD entry and curl's security advisory for the affected and fixed versions, and whether a default configuration is exposed.","how_to_check":"- Run `curl --version` and compare against the fixed version in the advisory (unknown in the sources).\n- Find scripts or services that call curl with `--negotiate`, `--anyauth` or Kerberos/GSSAPI auth and follow redirects (`-L`).","needs_analyst":true,"not_affected_if":["no-negotiate-auth","no-redirect-following","no-kerberos-tickets"],"who_is_affected":"Systems that run curl with Negotiate (Kerberos/SPNEGO) authentication and follow HTTP redirects, especially when the client runs under a user identity with Kerberos tickets and the target server is not fully trusted. Hosts that never use Negotiate auth or do not follow redirects with curl are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3387,"output_tokens":677,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-94265':15A,18A 'absenc':163C 'along':55B 'ambient':76B,139C 'arbitrari':124C 'auth':24B 'authent':50B,113C 'built':71B 'bypass':153C 'client':74B,143C 'compon':98C 'consequ':115C 'contain':36B,93C,123C 'curl':1A,19B,28B,64B,99C,128C 'cve':13A,16A 'domain':156C 'domain-scop':155C 'effect':152C 'enforc':160C 'erron':101C 'follow':29B 'forc':127C 'fresh':67B,132C 'generat':136C 'host':46B,84B,109C,151C 'http':2A,31B,48B,88C,111C 'ident':77B,140C 'keep':43B 'kerbero':8A,20B,69B,134C 'leak':6A 'linux':21B 'locat':166C 'location-trust':165C 'make':63B 'malici':57B,117C 'might':100C 'mint':68B,133C 'negoti':7A,23B,49B,112C 'negotiate-auth':22B 'normal':159C 'origin':45B,108C 'parti':12A,83B,150C 'password':40B,97C 'process':86C,144C 're':105C 're-transmit':104C 'redirect':3A,32B,89C,122C 'restrict':158C 'retain':102C 'runtim':25B 'scope':157C 'send':53B,65B,130C 'server':58B,118C 'state':51B,114C 'third':11A,82B,149C 'third-parti':81B,148C 'ticket':9A,70B,135C 'transmit':106C 'trigger':120C 'trust':167C 'untrust':80B,147C 'url':35B,92C 'use':60B,137C 'userinfo':5A,94C,125C 'usernam':38B,96C 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Systems that run curl with Negotiate (Kerberos/SPNEGO) authentication and follow HTTP redirects, especially when the client runs under a user identity with Kerberos tickets and the target server is not fully trusted. Hosts that never use Negotiate auth or do not follow redirects with curl are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}