Bug 2550343 (CVE-2026-86414)

Summary:	CVE-2026-86414 curl: curl: leaking host credentials to HTTP proxy
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, anthomas, aos-team-art-private, asdas, csutherl, dpaolell, ehelms, ggainey, jclere, jdelft, jpasqual, jupierce, juwatts, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhel-process-autobot, security-response-team, sghai, sidsharm, smallamp, suppawar, szappis, tmalecek, vchlup, vlaad, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 10:24:06 UTC

A HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86414 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.10.8 to and including 8.22.0
- Not affected versions: curl < 7.10.8 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/52ceab5e41a01b4d1227876

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid HTTP proxies

TIMELINE
--------

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!