Unscored severity · published Oct 20, 2026
CVE-2026-86413
Negotiate credentials sent to redirected origin
–
CVSS
0.3%
EPSS
No
On KEV
Description
When using an *ambient user* in a first transfer doing Negotiate
authentication and asked to follow redirects, curl could pass on its
credential details to an unrelated second origin when asked to redirect there.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.22.0 through 8.22.0; 8.21.0 through 8.21.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86413
curl.se
https://curl.se/docs/CVE-2026-86413.html
curl.se
https://curl.se/docs/CVE-2026-86413.json
hackerone.com
https://hackerone.com/reports/3993549
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF