Insufficiently protected credentials in cURL - CVE-2026-8926

Vulnerability identifier: #VU135084

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-8926

CWE-ID: CWE-522

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to use credentials intended for another user.

The vulnerability exists due to insufficiently protected credentials in .netrc credential handling when processing a URL that specifies a username without a password. A remote user can supply a URL with a username that has no matching .netrc entry to use credentials intended for another user.

This issue occurs only when curl is configured to use a .netrc file and the target host has credentials stored for a different user.

cURL
LANTIME Operating System Firmware (LTOS)
Ubuntu
openEuler
Fedora
curl (Ubuntu package)
curl
curl-help
libcurl-devel
libcurl
curl-debugsource
curl-debuginfo

Install security update from vendor's website.

cURL - update to 8.21.0
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm20, 7.47.0-1ubuntu2.19+esm16, 7.58.0-2ubuntu3.24+esm9, 7.68.0-1ubuntu2.25+esm4, 7.81.0-1ubuntu1.25, 8.5.0-2ubuntu10.10, 8.14.1-2ubuntu1.4, 8.18.0-1ubuntu2.2
curl - update to 8.4.0-33
curl-help - update to 8.4.0-33
libcurl-devel - update to 8.4.0-33
libcurl - update to 8.4.0-33
curl-debugsource - update to 8.4.0-33
curl-debuginfo - update to 8.4.0-33
curl - addressed in versions 8.15.0-8.fc43, 8.18.0-8.fc44

• https://curl.se/docs/CVE-2026-8926.html
• https://github.com/curl/curl/commit/4ae1d7cc2643e47

• Multiple vulnerabilities in cURL
• Ubuntu update for curl
• openEuler 24.03 LTS SP3 update for curl
• openEuler 24.03 LTS SP1 update for curl
• openEuler 24.03 LTS SP4 update for curl
• Fedora 44 update for curl
• Fedora 43 update for curl
• Multiple vulnerabilities in Meinberg LANTIME firmware