Insufficiently protected credentials in cURL - CVE-2026-94266
Published: October 14, 2026
Vulnerability identifier: #VU155671
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-94266
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to obtain sensitive credentials.
The vulnerability exists due to insufficient protection of credentials in the curl_easy_getinfo CURLINFO_EFFECTIVE_URL option when retrieving credentials from a .netrc file. A local user can read credentials exposed in the returned effective URL to obtain sensitive credentials.
Credentials can appear even when neither the original URL nor the redirected URL contains them. The curl command-line option --write-out '%{url_effective}' exposes the same information.
Affected software
cURL
How to mitigate CVE-2026-94266
Install security update from vendor's website.
cURL - update to 8.23.0