CVE-2026-7168: 
cURL vulnerability analysis and mitigation

CVE-2026-7168 is a cross-proxy Digest authentication state leak vulnerability in libcurl, officially named "cross-proxy Digest auth state leak." It affects libcurl versions 7.12.0 through 8.19.0 (inclusive) and was introduced at commit fc6eff13b5414caf6edf. The vulnerability was reported on April 27, 2026, and publicly disclosed on April 29, 2026, coordinated with the release of curl 8.20.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (curl Advisory, Openwall).

The root cause is improper state management in libcurl's handle reuse logic, classified as CWE-294 (Authentication Bypass by Capture-replay). When an application uses the same libcurl handle to perform a transfer through proxyA using HTTP Digest authentication, and then reconfigures the handle to use a different proxy (proxyB) for a subsequent transfer, libcurl incorrectly forwards the Proxy-Authorization: header — containing the Digest authentication credentials for proxyA — to proxyB. A malicious proxyB could then use this captured header to impersonate the client when communicating with proxyA. Notably, this flaw only affects the libcurl library and does not impact the curl command-line tool, and the advisory notes it is not considered a C language-specific mistake (curl Advisory, curl JSON).

The primary impact is a confidentiality breach: a malicious second proxy (proxyB) can capture the Proxy-Authorization: header containing Digest authentication state intended for proxyA, and use it to impersonate the client in subsequent communications with proxyA. This could allow credential replay attacks against the first proxy, potentially enabling unauthorized access to resources protected by that proxy. The impact is limited to scenarios where an attacker controls or can observe proxyB, and there is a partial mitigation in that proxyB receives no information about proxyA's address or identity from the request details alone (curl Advisory, Openwall).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2026-7168. A HackerOne report (report #3697719) is referenced as the original disclosure, but its full contents are not publicly accessible. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control or intercept traffic at a second proxy that the victim application connects to after switching proxies while reusing a libcurl handle (curl Advisory, Feedly).

1. Identify a target application: Find an application that uses libcurl (versions 7.12.0–8.19.0) and reuses curl handles across multiple HTTP proxy connections with Digest authentication enabled.
2. Position as a malicious proxy: Set up or compromise a proxy server (proxyB) that the target application will connect to after it has already authenticated through a legitimate proxy (proxyA) using Digest auth.
3. Trigger handle reuse: Cause or wait for the target application to switch its proxy configuration from proxyA to proxyB while reusing the same libcurl handle for a new transfer.
4. Capture the leaked header: Observe the incoming request to proxyB — it will contain the Proxy-Authorization: header with the Digest authentication credentials originally intended for proxyA.
5. Replay credentials: Use the captured Proxy-Authorization: header to send requests to proxyA, impersonating the client and potentially gaining unauthorized access to resources behind proxyA (curl Advisory, Openwall).

• Network: Unexpected Proxy-Authorization: headers (using Digest scheme) appearing in requests destined for a proxy that was not the original authentication target; outbound connections from an application to multiple distinct proxy hosts in rapid succession using the same session context.
• Logs: Application or proxy access logs showing Digest authentication headers being sent to a proxy that was not configured as the initial authenticated proxy; repeated proxy authentication attempts from the same source IP to different proxy endpoints.
• Application Behavior: Libcurl-based applications exhibiting authentication failures or unexpected authorization errors when switching between proxy configurations, which may indicate the leaked header is being rejected or misused.

The primary fix is to upgrade curl and libcurl to version 8.20.0 or later, which was released on April 29, 2026 (curl Advisory). If upgrading immediately is not possible, the patch can be applied manually to the existing version and libcurl rebuilt (fix commit: c1cfdf59acbaf9504c45). As a configuration-based workaround, applications should avoid reusing libcurl handles when changing proxy configurations — creating a new handle for each distinct proxy connection eliminates the state leak. Ubuntu has also issued security notice USN-8227-1 addressing this vulnerability (Ubuntu Advisory).

The vulnerability was disclosed by curl maintainer Daniel Stenberg via the oss-security mailing list on April 29, 2026, coordinated with the curl 8.20.0 release (Openwall). Daniel Stenberg's blog post announcing curl 8.20.0 also covered this advisory (curl Blog). Downstream projects including Ubuntu, Puppet, Unraid, HashiCorp Consul, and Yocto Project have issued updates or advisories referencing this CVE. Community reception has been measured given the Medium severity rating and the limited exploitation preconditions required.