Improper Certificate Validation in cURL - CVE-2026-87865
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to obtain SSH credentials and supply attacker-controlled SFTP data.
The vulnerability exists due to incorrect classification of mismatched SSH host keys in libcurl's host key validation callback handling when validating host keys against a hashed known_hosts file containing an unrelated initial entry. A remote attacker can control or intercept the reached SSH endpoint and make an already pinned host appear new to a trust-on-first-use callback to obtain SSH credentials and supply attacker-controlled SFTP data.
Only libcurl builds using the libssh2 backend for SFTP and SCP transfers are affected. The default callback and curl command-line tool are not claimed affected.