curl: Negotiate credentials sent to redirected origin
Summary
curl sends Negotiate (Kerberos) credentials to an unrelated second origin when it follows a redirect. The flaw affects transfers that use an ambient user, meaning curl is given a blank username and passes on the credentials provided by the Kerberos system. An attacker must control or influence a redirect target, and the redirect must point to a URL with embedded user credentials; the bug does not trigger if usernames in URLs are disallowed. The vendor rates the issue Low, while NVD lists a CVSS score of 9.1 (Critical) with analysis pending.
Affected
- curl 8.21.0 to and including 8.22.0
- Versions before 8.21.0 are not affected by this CVE.
- Versions 8.23.0 and later are not affected.
- The curl command line tool is also affected.
Fixed in
- curl 8.23.0 (fix commit 43029e2ec37eba2354ced199ccd8898de695858e)
- Other vendors' patched package versions: Unknown.
Workaround
- Do not use an ambient user together with redirects.
- Disallow usernames in URLs, which prevents the trigger.
- Apply the vendor patch to the local curl version.
Exploitation
- Exploited in the wild: Unknown; no reports found.
- Public proof of concept: none found for this CVE.
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
Our recommendation
- Upgrade curl to version 8.23.0 or later, including the command line tool and libcurl-based applications.
- Check whether systems use curl with Kerberos ambient credentials and redirect following, for example in scripts, backend jobs or domain-joined Linux environments, and prioritise these hosts.
- Ensure that clients do not send requests with embedded credentials to untrusted hosts.
- Check vendor advisories of your Linux distribution or appliance for patched packages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-86413 curl.se
- curl advisory JSON metadata curl.se
- curl 8.23.0 release announcement curl.se
- OSV entry CURL-CVE-2026-86413 osv.dev
- Debian security tracker for curl security-tracker.debian.org
- Ubuntu security notice CVE-2026-86413 ubuntu.com
- Original HackerOne report hackerone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:13.
Original description (NVD)
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.