---
id: "CVE-2026-94266"
kind: "vulnerability"
aliases: ["CVE-2026-94266"]
title: "libcurl: effective URL option can leak credentials not present in input"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["applications-using-curl", "c", "libcurl", "package"]
not_affected_if: []
published_at: "2026-10-20T21:17:22+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T05:04:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94266", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# libcurl: effective URL option can leak credentials not present in input

libcurl could return a URL from curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option that contains credentials, even though neither the original URL nor the redirect target contained them. An application that reads this value and logs, stores or displays it could expose those credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94266

## From the sources

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither
the URL provided to libcurl nor the redirected URL did.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_