Bug 2550356 (CVE-2026-86410)

Summary:	CVE-2026-86410 curl: curl: redirect to SFTP or SCP bypasses host verification
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, anthomas, aos-team-art-private, asdas, csutherl, dpaolell, ehelms, ggainey, jclere, jdelft, jpasqual, jupierce, juwatts, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhel-process-autobot, security-response-team, sghai, sidsharm, smallamp, suppawar, szappis, tmalecek, vchlup, vlaad, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 11:25:16 UTC

A flaw in the curl commanda line tool's logic makes it only set SSH host
verification options when interacting directly using SFTP or SCP, and not as a
result of following a redirect.

* INFO

This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never
installed when the initial URL is HTTPS. If `--location` and
`--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com`
redirect, the SFTP connection proceeds without any of the user's requested SSH host
verification methods. It should be noted that following and allowing redirects to
SFTP or SCP is rare.

This problem is similar, but not identical, to
[CVE-2026-12064](https://curl.se/docs/CVE-2026-12064.html).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86410 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Low

** AFFECTED VERSIONS

- Affected versions: curl 7.81.0 to and including 8.22.0
- Not affected versions: curl < 7.81.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/

curl is used by many applications, but not always advertised as such!

This flaw is only affecting the curl command line tool, not libcurl.

** SOLUTION

- Fixed-in: https://github.com/curl/curl/commit/6ae9befb2fb6bdfdb5fc11fdf76b

** TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

** CREDITS

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg