Executive brief
curl is a widely-used file transfer tool that supports SSH-based protocols like SFTP and SCP. When configured to use public key authentication, curl would incorrectly fall back to authenticating via a locally running SSH agent, potentially allowing unintended key use. This bypasses the intended authentication method and could allow an attacker with access to a compromised SSH agent to transfer files using credentials they should not have access to.
Technical details
This is an authentication bypass vulnerability (CWE-287) in curl's libssh backend when performing SCP or SFTP transfers with public key authentication. When libssh is configured for key-based auth without an explicit agent, the underlying libssh library unexpectedly falls back to checking a locally running SSH agent. An attacker who compromises or controls an SSH agent on the system can intercept or abuse this fallback to authenticate with keys the agent holds. The vulnerability affects curl versions 7.58.0 through 8.17.0 (with patch releases 8.14.2, 8.16.1, and 8.18.0 being unaffected). The issue is fixed in curl 8.18.0; as a workaround, users can rebuild curl with the libssh2 backend instead.
Affected products
- curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+
Timeline
- 2026-01-07: disclosed: CVE-2025-15224 advisory published
- 2026-01-07: patched: curl 8.18.0 released with fix
- 2025-12-28: other: Vulnerability reported to curl project