cross-origin reuse of a Negotiate connection
============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87861.html)

VULNERABILITY
-------------

When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leaving the request's intended credentials unutilized.

INFO
----

An *ambient user* means that a blank user name is provided and the real
identity and credentials are handled under curl's radar.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87861 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.21.0 to and including 8.22.0
- Not affected versions: curl < 8.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/bd10924b47c8bf94127eaee

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/7c11f1a1bd53e2cd983fe153e4599

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid using *ambient users* for authentication

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Axel Mierczuk
- Patched-by: Stefan Eissing

Thanks a lot!