{"id":"CURL-CVE-2026-86410","summary":"redirect to SFTP or SCP bypasses host verification","details":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.","aliases":["CVE-2026-86410"],"modified":"2026-10-14T07:00:03.763373068Z","published":"2026-10-14T08:00:00Z","database_specific":{"URL":"https://curl.se/docs/CVE-2026-86410.json","www":"https://curl.se/docs/CVE-2026-86410.html","issue":"https://hackerone.com/reports/3973176","CWE":{"desc":"Improper Validation of Certificate with Host Mismatch","id":"CWE-297"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"tool"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.81.0"},{"fixed":"8.23.0"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0","8.7.1","8.7.0","8.6.0","8.5.0","8.4.0","8.3.0","8.2.1","8.2.0","8.1.2","8.1.1","8.1.0","8.0.1","8.0.0","7.88.1","7.88.0","7.87.0","7.86.0","7.85.0","7.84.0","7.83.1","7.83.0","7.82.0","7.81.0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-86410.json"}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}