CVE-2026-94266: 
cURL vulnerability analysis and mitigation

CVE-2026-94266 is a credential disclosure vulnerability in libcurl, described as a "password leak in CURLINFO_EFFECTIVE_URL." When an application calls curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option, libcurl can accidentally return a URL that contains credentials — even though neither the original URL nor any redirected URL included them. This occurs specifically when credentials are sourced from a .netrc file. The vulnerability affects curl versions 7.62.0 through 8.22.0 and was fixed in curl 8.23.0 (released October 14, 2026). It carries a Low severity rating (CWE-522: Insufficiently Protected Credentials) with an EPSS score of 0.0 (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): libcurl improperly embeds credentials retrieved from a .netrc file into the effective URL string returned by CURLINFO_EFFECTIVE_URL, even when those credentials were not part of the original or redirected request URL. The vulnerability was introduced in commit 46e164069d1a5230e4e64cbd2ff46c46cce056bb and fixed in commit 7a6bd027d0de2b6857472d35da090ef60cc29f19. The curl command-line tool is also affected via the equivalent --write-out '%{url_effective}' option. Exploitation requires that the application uses .netrc-based authentication and queries CURLINFO_EFFECTIVE_URL after a transfer (curl Advisory, curl JSON).

The primary impact is confidentiality loss: authentication credentials (usernames and passwords) stored in a .netrc file can be inadvertently exposed through the effective URL returned by libcurl. Any application that logs, caches, displays, or transmits the value of CURLINFO_EFFECTIVE_URL may unintentionally leak these credentials to logs, monitoring systems, third-party services, or other code with access to the URL string. There is no direct integrity or availability impact, but exposed credentials could enable unauthorized access to downstream systems, facilitating lateral movement (curl Advisory, Ubuntu USN-8927-1).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack type is classified as credential/token disclosure, and exploitation is passive in nature — an attacker would need access to application logs, outputs, or interfaces that expose the effective URL value rather than directly interacting with libcurl (Feedly, curl Advisory).

1. Identify a target application: Find an application that uses libcurl (versions 7.62.0–8.22.0), authenticates via a .netrc file, and calls curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL (or uses --write-out '%{url_effective}' in the curl CLI).
2. Trigger a transfer: Cause the application to perform an HTTP/FTP transfer that uses .netrc credentials — this can be done by interacting with the application's normal functionality.
3. Access the effective URL output: Obtain the value of CURLINFO_EFFECTIVE_URL from application logs, debug output, monitoring dashboards, error messages, or any interface that exposes this string.
4. Extract credentials: Parse the returned URL string for embedded username and password fields (e.g., https://user:password@example.com/path), which libcurl has incorrectly included from the .netrc file (curl Advisory).

• Logs: Application or web server logs containing URLs with embedded credentials in the format scheme://user:password@host/path sourced from CURLINFO_EFFECTIVE_URL output.
• File System: Presence of .netrc files in user home directories or application working directories that contain plaintext credentials; review whether these credentials appear in log files.
• Application Output: Debug or verbose curl output (e.g., from --write-out '%{url_effective}') containing credential-embedded URLs in stdout/stderr captures.
• Monitoring/Observability: Traces, metrics, or APM data that record effective URLs as attributes or labels, potentially exposing credentials to third-party monitoring platforms.

The primary remediation is to upgrade curl/libcurl to version 8.23.0 or later. For deployments on maintenance branches, fixed versions are also available: 8.14.3+ (8.14.x branch), 8.16.2+ (8.16.x branch), and 8.20.2+ (8.20.x branch). As a workaround, avoid using CURLINFO_EFFECTIVE_URL (or --write-out '%{url_effective}') in applications that authenticate via .netrc. Additionally, audit any existing logs, caches, or outputs that may have captured effective URLs containing credentials, and rotate any potentially exposed credentials. Ubuntu has released patches via USN-8927-1 (Ubuntu 26.04 LTS: curl 8.18.0-1ubuntu2.8) and USN-8927-2 (Ubuntu 26.10: curl 8.20.0-2ubuntu11.1) (curl Advisory, Ubuntu USN-8927-1, Ubuntu USN-8927-2).

The vulnerability was part of a broader curl 8.23.0 security release that addressed 24 vulnerabilities, which received coverage from technology media including Heise Online. The curl project credited Joshua Rogers of Aisle Research as the reporter and Daniel Stenberg as the patch developer. The release was noted for also removing SMB support alongside the security fixes (curl Advisory).