Authorization: Negotiate sent to foreign origin
===============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-94265.html)

VULNERABILITY
-------------

When processing an HTTP redirect to a URL containing userinfo (a
`username:password` component), curl might erroneously retain and re-transmit
the original host's HTTP Negotiate authentication state. Consequently, a
malicious server can trigger a redirect containing arbitrary userinfo to force
curl to send a freshly minted Kerberos ticket—generated using the ambient
identity of the client process to an untrusted third-party host, effectively
bypassing the domain-scoping restrictions normally enforced by the absence of
`--location-trusted`.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-94265 to this issue.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity: low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.21.0 to and including 8.22.0
- Not affected versions: curl < 8.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/8f71d0fde515aa4c68002

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/557a52f21e37a626725a9e708c

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not follow directs when using Negotiate

TIMELINE
--------

This issue was reported to the curl project on September 18, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Joshua Rogers (Aisle Research)

Thanks a lot!