Improper validation of certificate with host mismatch in cURL - CVE-2026-86410
Published: October 14, 2026
Vulnerability identifier: #VU155691
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86410
CWE-ID: CWE-297
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass SSH host verification.
The vulnerability exists due to improper initialization of SSH host verification options in the curl command-line tool when following redirects from HTTPS to SFTP or SCP. A remote attacker can return a redirect to an SFTP or SCP destination to bypass SSH host verification.
Exploitation requires redirect following and redirects to SFTP or SCP to be enabled. The requested verification methods specified through --knownhosts, --hostpubsha256, or --hostpubmd5 are not applied to the redirected connection. libcurl is not affected.
Affected software
cURL
How to mitigate CVE-2026-86410
Install security update from vendor's website.
cURL - update to 8.23.0