Insertion of Sensitive Information Into Sent Data in cURL - CVE-2026-87861
Published: October 14, 2026
Vulnerability identifier: #VU155685
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87861
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper isolation of authenticated connections between origins in curl's HTTP connection reuse logic when sending HTTP requests using ambient user credentials. A remote attacker can exploit reuse of a connection previously authenticated via Negotiate for a different origin to disclose sensitive information.
Ambient credentials are used when a blank user name is provided and the actual identity and credentials are managed outside curl.
Affected software
cURL
How to mitigate CVE-2026-87861
Install security update from vendor's website.
cURL - update to 8.23.0