Bug 2550594 (CVE-2026-86413)

Summary:	CVE-2026-86413 curl: curl: Negotiate credentials sent to redirected origin
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 14:51:58 UTC

Negotiate credentials sent to redirected origin
===============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-86413.html)

VULNERABILITY
-------------

When using an *ambient user* in a first transfer doing Negotiate
authentication and asked to follow redirects, curl could pass on its
credential details to an unrelated second origin when asked to redirect there.

INFO
----

*ambient user* is the term used for when curl itself does not actually know
the credentials, but curl has been instructed to pass on what the kerberos
system provides it. This is accomplished by providing a blank username to
curl.

To trigger this flaw, the redirect needs to be done to a URL with userauth
details (name and password) like `https://user:pass@evil.example/`. This is a
rare style, unless done on purpose.

This bug also does not trigger if curl was told to disallow usernames in URLs.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86413 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.21.0 to and including 8.22.0
- Not affected versions: curl < 8.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/8f71d0fde515aa4c68002477

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/43029e2ec37eba2354ced199ccd88

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not a ambient user with redirects

TIMELINE
--------

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!