curl: Host key verification bypass after redirect to SFTP or SCP
Summary
The curl command line tool does not apply SSH host verification options (--knownhosts, --hostpubsha256, --hostpubmd5) when a connection is redirected to SFTP or SCP. An attacker who controls or intercepts the server response can redirect the transfer to an SFTP or SCP server, which then proceeds without the requested host key checks. The issue requires --location combined with --proto-redir +sftp or +scp and is only exploitable in a man-in-the-middle or server-controlled scenario; libcurl is not affected.
Affected
- curl command line tool 7.81.0 up to and including 8.22.0
- Not affected: versions before 7.81.0 and 8.23.0 or later
- Not affected: 8.20.2 or later in the 8.20.X branch, 8.16.2 or later in the 8.16.X branch, 8.14.3 or later in the 8.14.X branch
- Only the curl command line tool is affected, not libcurl
Fixed in
- Upgrade to curl 8.23.0 (released October 14, 2026)
- Or apply the fix commit 6ae9befb2fb6bdfdb5fc11fdf76bbe519fe1f52c to your local version
- Distribution packages may be backported; check your vendor's security advisories
Workaround
- Do not allow redirects to SFTP or SCP (do not combine --location with --proto-redir +sftp or +scp)
- Keep the default protocol restrictions for redirects
- Do not rely on SSH host-key options as a substitute control
Exploitation
- CISA SSVC: exploitation status PoC, not automatable
- No known exploitation in the wild and no public proof of concept found at the time of research
- EPSS is low (about 0.008)
Our recommendation
- Inventory curl on Linux servers and appliances (curl --version)
- Update to curl 8.23.0 or your distribution's backported fix
- Check scripts and tooling for --location combined with SFTP or SCP redirects and disable them
- Prioritise under normal patch cycles unless such scripts are in use; the practical risk is low to medium despite the NVD score of 8.1
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-86410 curl.se
- curl CVE JSON metadata curl.se
- Original report on HackerOne hackerone.com
- Debian security tracker security-tracker.debian.org
- OSV entry CURL-CVE-2026-86410 osv.dev
- Ubuntu blog on curl vulnerability fixes ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:37.
Original description (NVD)
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.