Bug 2446450 (CVE-2026-3783) - CVE-2026-3783 curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect
Summary: CVE-2026-3783 curl: curl: Information disclosure via OAuth2 bearer token leak...
Keywords:
Status: NEW
Alias: CVE-2026-3783
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2446482 2446483 2446472 2446473 2446474 2446475 2446476 2446477 2446478 2446480 2446484 2446485 2446486 2446487
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-11 11:01 UTC by OSIDB Bzimport
Modified: 2026-08-17 05:43 UTC (History)
28 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:55439 0 None None None 2026-08-17 05:43:53 UTC
Red Hat Product Errata RHSA-2026:55450 0 None None None 2026-08-17 04:40:21 UTC

Description OSIDB Bzimport 2026-03-11 11:01:24 UTC 
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a redirect to a second URL, curl could leak that token to the second
hostname under some circumstances.

If the hostname that the first request is redirected to has information in the
used .netrc file, with either of the `machine` or `default` keywords, curl
would pass on the bearer token set for the first host also to the second one.
Comment 4 errata-xmlrpc 2026-08-17 04:40:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55450 https://access.redhat.com/errata/RHSA-2026:55450
Comment 5 errata-xmlrpc 2026-08-17 05:43:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55439 https://access.redhat.com/errata/RHSA-2026:55439
Note You need to log in before you can comment on or make changes to this bug.