Bug 2550712 (CVE-2026-94265)

Summary: CVE-2026-94265 curl: curl: Authorization: Negotiate sent to foreign origin
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-14   

Description OSIDB Bzimport 2026-10-13 17:29:45 UTC 
Authorization: Negotiate sent to foreign origin
===============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-94265.html)

VULNERABILITY
-------------

When processing an HTTP redirect to a URL containing userinfo (a
`username:password` component), curl might erroneously retain and re-transmit
the original host's HTTP Negotiate authentication state. Consequently, a
malicious server can trigger a redirect containing arbitrary userinfo to force
curl to send a freshly minted Kerberos ticket—generated using the ambient
identity of the client process to an untrusted third-party host, effectively
bypassing the domain-scoping restrictions normally enforced by the absence of
`--location-trusted`.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-94265 to this issue.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity: low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.21.0 to and including 8.22.0
- Not affected versions: curl < 8.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/8f71d0fde515aa4c68002

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/557a52f21e37a626725a9e708c

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not follow directs when using Negotiate

TIMELINE
--------

This issue was reported to the curl project on September 18, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Joshua Rogers (Aisle Research)

Thanks a lot!