curl / libcurl: Cross-origin connection reuse with Negotiate authentication
Summary
curl and libcurl can send an HTTP request for one origin over a connection that was previously authenticated via Negotiate for a different origin, so the request's intended credentials are not used. The issue only applies when ambient user credentials (a blank username) are used. The advisory describes the impact as information exposure through sent data, and the CNA rates the flaw Low, while the CVE program record shows CVSS 9.1 (Critical); this score is not confirmed by curl and appears inflated for this scenario.
Affected
- curl 8.21.0 through 8.22.0 (command-line tool and libcurl)
- Versions before 8.21.0 and 8.23.0 and later are not affected
- Only relevant when ambient user credentials with Negotiate are used
Fixed in
- curl 8.23.0 (released 14 October 2026)
- Upstream fix commit 7c11f1a1bd53e2cd983fe153e45991302d097647
- Distribution fix status varies; check your vendor's advisory (Debian bookworm and trixie reported fixed, others unverified)
Workaround
- Avoid using ambient user credentials for authentication
- Apply the upstream patch to your local curl build if an upgrade is not possible
- No further vendor-specific workaround known; it is unknown whether disabling connection reuse fully mitigates the issue
Exploitation
- No confirmed in-the-wild exploitation known
- No public proof of concept found; the original report is public on HackerOne
- CISA SSVC lists exploitation as PoC and automatable: yes
Our recommendation
- Inventory systems and applications that use curl or libcurl, including embedded tools and scripts
- Prioritise patching where Negotiate/Kerberos SSO with ambient credentials is used, for example Windows SSPI setups
- Upgrade to curl 8.23.0 or a fixed distribution package, or apply the upstream patch
- Stop using ambient user credentials where possible
- Check Windows-bundled or vendor-shipped curl builds individually
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-87861 curl.se
- curl CVE metadata JSON curl.se
- HackerOne original report hackerone.com
- OSV record CURL-CVE-2026-87861 osv.dev
- Debian security tracker for curl security-tracker.debian.org
- Ubuntu security notice CVE-2026-87861 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:55.
Original description (NVD)
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.