curl: Negotiate credentials sent to foreign origin after redirect
Summary
curl retains HTTP Negotiate authentication state when following a redirect to a URL containing userinfo. A malicious server can use such a redirect to make curl send a freshly generated Kerberos ticket, based on the client process's identity, to an untrusted third-party host. The attack requires a client that uses Negotiate authentication, follows redirects and has an ambient Kerberos identity; the server side does not need to be exposed.
Affected
- curl 8.21.0 through 8.22.0 (libcurl and the curl command-line tool)
- Versions before 8.21.0 and 8.23.0 or later are not affected according to the vendor advisory
Fixed in
- curl 8.23.0 (released October 14, 2026)
- Fix commit 557a52f21e37a626725a9e708c02af129c3ece1b
- Distribution packages: check the vendor tracker for the exact build (Debian forky is listed as vulnerable)
Workaround
- Do not follow redirects when using Negotiate authentication
- Apply the upstream patch to a local build
Exploitation
- No in-the-wild exploitation found in the research. Unverified against the CISA KEV catalogue.
- No public proof-of-concept found. The original HackerOne report is public.
- CISA SSVC lists exploitation as poc and automatable as yes.
Our recommendation
- Inventory curl and libcurl on servers, workstations and embedded tools, and check whether the version is 8.21.0 to 8.22.0.
- Upgrade to curl 8.23.0 or the fixed distribution package.
- Until patched, stop following redirects in scripts, backup jobs and tools that use Negotiate authentication.
- Watch the NVD record for the final score and any KEV listing. The vendor rates the issue low; the NVD score of 9.1 is awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-94265 curl.se
- curl CVE JSON metadata curl.se
- Original report (HackerOne 4040551) hackerone.com
- Ubuntu security notice CVE-2026-94265 ubuntu.com
- Debian security tracker curl security-tracker.debian.org
- OSV CURL-CVE-2026-94265 osv.dev
- VulDB entry 424066 vuldb.com
- Red Hat RHSA-2026:82895 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:52.
Original description (NVD)
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.