{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94265", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-09-21T09:07:44.636Z", "datePublished": "2026-10-20T20:26:18.061Z", "dateUpdated": "2026-10-20T20:26:18.061Z"}, "containers": {"cna": {"title": "Authorization: Negotiate sent to foreign origin", "descriptions": [{"lang": "en", "value": "When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket\u2014generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-10-20T20:26:18.061Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.22.0", "status": "affected", "lessThanOrEqual": "8.22.0", "versionType": "semver"}, {"version": "8.21.0", "status": "affected", "lessThanOrEqual": "8.21.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-94265.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-94265.html", "name": "www"}, {"url": "https://hackerone.com/reports/4040551", "name": "issue"}], "credits": [{"lang": "en", "value": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Joshua Rogers (Aisle Research)", "type": "remediation developer"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThanOrEqual": "8.22.0", "status": "affected", "version": "8.22.0", "versionType": "semver"}, {"lessThanOrEqual": "8.21.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket\u2014generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}], "id": "CVE-2026-94265", "lastModified": "2026-10-20T21:17:22.183", "metrics": {}, "published": "2026-10-20T21:17:22.183", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-94265.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-94265.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://hackerone.com/reports/4040551"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Received"}

{"acknowledgement": "Red Hat would like to thank Joshua Rogers (Aisle Research) for reporting this issue.", "bugzilla": {"description": "curl: curl: Authorization: Negotiate sent to foreign origin", "id": "2550712", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550712"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries."], "name": "CVE-2026-94265", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Not affected", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94265\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94265"], "statement": "This vulnerability is rated as Low severity because exploitation requires a specific, non-default combination of features, including Kerberos-based authentication and automatic redirection handling. In typical Red Hat deployments, clients only face exposure if an application or script connects to a malicious server that redirects requests to an untrusted third party using credentials embedded in the destination URL. Because curl does not follow HTTP redirects by default and Negotiate authentication is restricted to targeted enterprise workflows, the potential blast radius is limited.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "curl", "vendor": "curl"}], "created": "2026-10-17T02:15:14.837387+00:00", "updated": "2026-10-18T19:45:00.604116+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}