CVE-2026-94265: 
cURL vulnerability analysis and mitigation

CVE-2026-94265 is a credential/token disclosure vulnerability in curl titled "Authorization: Negotiate sent to foreign origin." When curl follows an HTTP redirect to a URL containing a username:password userinfo component, it may erroneously retain and re-transmit the original host's HTTP Negotiate authentication state, sending a freshly minted Kerberos ticket to an untrusted third-party host. The vulnerability affects curl versions 8.21.0 and 8.22.0, and was fixed in curl 8.23.0 released on October 14, 2026. It is classified as Low severity (CWE-200) by the curl project, with an EPSS score of 0.0 (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw was introduced in curl commit 8f71d0fde515aa4c68002477356c35bd79927729 and fixed in commit 557a52f21e37a626725a9e708c02af129c3ece1b. When curl processes an HTTP redirect to a URL that includes a userinfo (username:password) component, it fails to properly reset the HTTP Negotiate authentication state from the original host, causing it to forward a Kerberos ticket — derived from the client process's ambient identity — to the redirect target. This effectively bypasses the domain-scoping protections that would normally require the --location-trusted flag to be explicitly set. The issue was reported and patched by Joshua Rogers of Aisle Research (curl Advisory, curl JSON).

A malicious server can exploit this vulnerability to steal Kerberos authentication tickets generated from the client process's ambient identity by redirecting curl to an attacker-controlled host with a crafted userinfo URL component. This results in unauthorized disclosure of Kerberos credentials, which could enable impersonation of the affected user or service account within the Kerberos realm. Both the curl command-line tool and applications using libcurl are affected, broadening the potential attack surface to any system or application relying on curl with HTTP Negotiate/Kerberos authentication (curl Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control or compromise a server that curl communicates with, limiting the attack surface to scenarios where clients follow redirects from untrusted servers using Negotiate/Kerberos authentication (curl Advisory, GitHub Advisory).

1. Set up a malicious server: The attacker operates or compromises an HTTP server that curl clients are expected to contact.
2. Trigger a redirect with userinfo: When a curl client (using HTTP Negotiate/Kerberos authentication) makes a request, the malicious server responds with an HTTP redirect (e.g., 302) to a URL containing a crafted userinfo component, such as http://user:pass@attacker-controlled-host.example.com/.
3. Exploit curl's state retention bug: curl, upon following the redirect, erroneously retains the HTTP Negotiate authentication state from the original host and re-transmits it to the redirect target, generating and sending a fresh Kerberos ticket using the client's ambient identity.
4. Capture the Kerberos ticket: The attacker's controlled third-party host receives the Kerberos ticket, which can then be used to impersonate the victim within the Kerberos realm or for further lateral movement (curl Advisory).

• Network: Unexpected outbound HTTP requests from curl clients to unfamiliar or attacker-controlled hosts, particularly those with userinfo components in the URL (e.g., http://user:pass@external-host/); Kerberos ticket-granting service (TGS) requests for unusual or external service principals.
• Logs: curl access or debug logs showing Authorization: Negotiate headers sent to hosts other than the originally intended server; HTTP 302 redirect responses from servers directing clients to URLs with embedded credentials.
• Process: curl or libcurl-linked processes making connections to unexpected external hosts immediately following a redirect from a known server.

Upgrade curl to version 8.23.0 or later, which was released on October 14, 2026, and contains the fix (curl Advisory). As a workaround, avoid following redirects when using HTTP Negotiate/Kerberos authentication by disabling redirect following (omit -L/--location in curl invocations). Alternatively, audit all systems and applications using curl 8.21.0 or 8.22.0 with Kerberos/Negotiate authentication to assess exposure, and restrict curl from following redirects from untrusted servers (GitHub Advisory).

The vulnerability was covered by Heise Online in the context of a broader curl 8.23.0 release that addressed 24 security vulnerabilities and removed SMB support (Heise). CybersecurityNews also reported on the curl security update. The issue was disclosed via the oss-security mailing list and tracked by Tenable and other vulnerability management platforms. Community reaction has been measured given the Low severity rating and absence of active exploitation.