libcurl: Host credentials leaked to HTTP proxy
Summary
libcurl sends the origin server's credentials, either a Basic password or a Negotiate/Kerberos ticket, to an HTTP proxy. This happens when the proxy answers the CONNECT tunnel request with 401 and a WWW-Authenticate header instead of the expected 407 and Proxy-Authenticate. The vendor rates the issue Low, and the CVSS 9.1 score given with this report is unverified. The curl command line tool is affected as well.
Affected
- curl 7.10.8 up to and including 8.22.0
- Vendor note: distributions may ship backported fixes, so check the package version in your distribution's advisory.
Fixed in
- curl 8.23.0 (released 14 October 2026)
- Fixed branch releases: 8.14.3 (8.14.X), 8.16.2 (8.16.X), 8.20.2 (8.20.X)
- Ubuntu 26.04 LTS: fixed in 8.18.0-1ubuntu2.8 according to the Ubuntu tracker
- Other distributions: Debian bookworm and trixie are still listed as vulnerable on the Debian tracker; check your vendor's advisory.
Workaround
- Avoid HTTP proxies for connections that use Basic or Negotiate authentication.
- Apply the vendor patch (commit 2956af6c7451029fb12c12f8166dff211f930d52) to your local build.
- Switching to a SOCKS proxy does not fix the vulnerability.
Exploitation
- The CISA SSVC assessment lists exploitation as "poc" and automatable as yes.
- No known exploitation in the wild, no CISA KEV listing and no public proof of concept were found in the sources reviewed.
- The attacker must control or sit in front of a proxy that the client uses.
Our recommendation
- Inventory all systems and embedded products that use libcurl or the curl command line tool, including build and runtime dependencies.
- Upgrade to curl 8.23.0 or to the fixed branch release, or install your distribution's patched package.
- Until patched, stop using HTTP proxies for authenticated requests, and restrict which proxies clients may use.
- Review forward proxies that you do not control, and check logs for credentials that may have been exposed.
- Prioritise systems that use proxies on untrusted networks and services that embed libcurl.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-86414 curl.se
- curl CVE metadata (JSON) curl.se
- Original report (HackerOne) hackerone.com
- Ubuntu security tracker ubuntu.com
- Debian security tracker security-tracker.debian.org
- OSV entry CURL-CVE-2026-86414 osv.dev
- Curl security update overview (Cybersecurity News) cybersecuritynews.com
- curl 8.23.0 security release guide (Puppyip) puppyip.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:01.
Original description (NVD)
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.