{"id":"CURL-CVE-2026-94265","summary":"Authorization: Negotiate sent to foreign origin","details":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`.","aliases":["CVE-2026-94265"],"modified":"2026-10-14T19:02:56.000690370Z","published":"2026-10-14T08:00:00Z","database_specific":{"package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-94265.json","www":"https://curl.se/docs/CVE-2026-94265.html","issue":"https://hackerone.com/reports/4040551","CWE":{"id":"CWE-200","desc":"Exposure of Sensitive Information to an Unauthorized Actor"},"last_affected":"8.22.0","severity":"Low"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"8f71d0fde515aa4c68002477356c35bd79927729"},{"fixed":"557a52f21e37a626725a9e708c02af129c3ece1b"}]}],"versions":["8.22.0","8.21.0","rc-8_23_0-1","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-94265.json","vanir_signatures":[{"target":{"file":"lib/http.c"},"deprecated":false,"digest":{"line_hashes":["258241408172650082274197032207243121182","202331025740140981690149075963320984142","133154582168718855543557165470914620252","222689747306617021041087690531354622781","331371883817691747955301164846343910716","173680396911909101058002944785969361573","293416567411974312668037515284358805963","33131427712633358860007974826071959084","65856464225235246825689409252828683080","176877547400910687471021854333076347618","63616142820591472155253770476859656451"],"threshold":0.9},"id":"CURL-CVE-2026-94265-1be73f6f","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/557a52f21e37a626725a9e708c02af129c3ece1b"},{"id":"CURL-CVE-2026-94265-56eeda09","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/557a52f21e37a626725a9e708c02af129c3ece1b","target":{"function":"output_auth_headers","file":"lib/http.c"},"deprecated":false,"digest":{"function_hash":"258589147120900445451495645580457467669","length":3103}}],"vanir_signatures_modified":"2026-10-14T19:02:56Z"}}],"schema_version":"1.9.0","credits":[{"name":"Joshua Rogers (Aisle Research)","type":"FINDER"},{"name":"Joshua Rogers (Aisle Research)","type":"REMEDIATION_DEVELOPER"}]}