{"id":"CVE-2026-94266","kind":"vulnerability","aliases":["CVE-2026-94266"],"related":[],"title":"libcurl: effective URL option can leak credentials not present in input","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.","summary":"libcurl could return a URL from curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option that contains credentials, even though neither the original URL nor the redirect target contained them. An application that reads this value and logs, stores or displays it could expose those credentials.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-using-curl","c","libcurl","package"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:17+00:00","updated_at":"2026-10-25T05:04:17+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:04:17Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"libcurl: effective URL option can leak credentials not present in input","impact":"low","summary":"libcurl could return a URL from curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option that contains credentials, even though neither the original URL nor the redirect target contained them. An application that reads this value and logs, stores or displays it could expose those credentials.","category":"package","nicknames":[],"who_cares":["libcurl","c","applications-using-curl"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Credentials appear in a returned URL and may leak to logs or output","analyst_note":"Sources give no affected or fixed versions and no advisory link beyond NVD; check the curl project security advisory for the affected version range and fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000514,"input_tokens":3307,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94266':14A,17A 'accident':73C 'applic':19B,56B 'applications-using-curl':18B 'c':22B 'contain':41B,53B,86C 'could':26B,67B,72C 'credenti':7A,42B,70B,87C 'curl':21B,31B,78C 'curlinfo':36B,82C 'cve':12A,15A 'display':65B 'easi':32B,79C 'effect':2A,37B,83C 'even':43B,88C 'expos':68B 'getinfo':33B,80C 'input':11A 'leak':6A 'libcurl':1A,23B,25B,71C,95C 'log':62B 'neither':45B,90C 'option':4A,39B,85C 'origin':47B 'packag':24B 'present':9A 'provid':93C 'read':58B 'redirect':51B,98C 'return':27B,74C 'store':63B 'target':52B 'though':44B,89C 'url':3A,29B,38B,48B,76C,84C,92C,99C 'use':20B 'valu':60B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}