Is CVE-2025-15224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15224 being exploited in the wild.

How severe is CVE-2025-15224?

Low severity, with a CVSS score of 3.1, published 8 January 2026.

Which products and versions are affected?

curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+.

Is there a fix for CVE-2025-15224?

A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-15224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15224?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15224: curl libssh key passphrase bypass without agent set

CVE-2025-15224 · Severity: low · CVSS 3.1 · Published 2026-01-08

curl is a widely-used file transfer tool that supports SSH-based protocols like SFTP and SCP. When configured to use public key authentication, curl would incorrectly fall back to authenticating via a locally running SSH agent, potentially allowing unintended key use. This bypasses the intended authentication method and could allow an attacker with access to a compromised SSH agent to transfer files using credentials they should not have access to.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2025-15224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15224 being exploited in the wild.
How severe is CVE-2025-15224?: Low severity, with a CVSS score of 3.1, published 8 January 2026.
Which products and versions are affected?: curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+.
Is there a fix for CVE-2025-15224?: A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-15224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15224?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authentication bypass vulnerability (CWE-287) in curl's libssh backend when performing SCP or SFTP transfers with public key authentication. When libssh is configured for key-based auth without an explicit agent, the underlying libssh library unexpectedly falls back to checking a locally running SSH agent. An attacker who compromises or controls an SSH agent on the system can intercept or abuse this fallback to authenticate with keys the agent holds. The vulnerability affects curl versions 7.58.0 through 8.17.0 (with patch releases 8.14.2, 8.16.1, and 8.18.0 being unaffected). The issue is fixed in curl 8.18.0; as a workaround, users can rebuild curl with the libssh2 backend instead.

Affected products

curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+

Timeline

2026-01-07: disclosed: CVE-2025-15224 advisory published
2026-01-07: patched: curl 8.18.0 released with fix
2025-12-28: other: Vulnerability reported to curl project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.