VDB
CVE-2026-86413
CVE-2026-86413
PUBLISHED
CVSS 9.1 CRITICAL
Reported by curl · Published October 20, 2026
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Risk Scores
CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | 8.22.0, 8.21.0 |
| curl | curl | 8.22.0, 8.21.0 |
| alpine | curl | 0 |
Timeline
- CVE Published
- Oct 14, 2026 PoC Published
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 PoC Published
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 EPSS Score