Bug 2550717 (CVE-2026-94266)

Summary:	CVE-2026-94266 curl: curl: password leak in CURLINFO_EFFECTIVE_URL
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 17:32:57 UTC

password leak in CURLINFO_EFFECTIVE_URL
=======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-94266.html)

VULNERABILITY
-------------

libcurl could accidentaly return a URL for curl_easy_getinfo's
`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither
the URL provided to libcurl nor the redirected URL did not.

INFO
----

The curl tool exposes the same information using the command line option:

    --write-out '%{url_effective}'

This credential leak can happen when curl retrieves credentials from a
`.netrc` file.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-94266 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.62.0 to and including 8.22.0
- Not affected versions: curl < 7.62.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/46e164069d1a5230e4e64

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/7a6bd027d0de2b6857472d35d

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not use `CURLINFO_EFFECTIVE_URL`.

TIMELINE
--------

This issue was reported to the curl project on September 18, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!