# CVE-2025-15224: curl libssh key passphrase bypass without agent set

Source: https://junglewise.ai/threats/cve-2025-15224-curl-libssh-key-passphrase-bypass-without-agent-set  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-15224 · Severity: low · CVSS 3.1 · Published 2026-01-08

curl is a widely-used file transfer tool that supports SSH-based protocols like SFTP and SCP. When configured to use public key authentication, curl would incorrectly fall back to authenticating via a locally running SSH agent, potentially allowing unintended key use. This bypasses the intended authentication method and could allow an attacker with access to a compromised SSH agent to transfer files using credentials they should not have access to.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2025-15224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15224 being exploited in the wild.

**How severe is CVE-2025-15224?** Low severity, with a CVSS score of 3.1, published 8 January 2026.

**Which products and versions are affected?** curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+.

**Is there a fix for CVE-2025-15224?** A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-15224 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-15224?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability (CWE-287) in curl's libssh backend when performing SCP or SFTP transfers with public key authentication. When libssh is configured for key-based auth without an explicit agent, the underlying libssh library unexpectedly falls back to checking a locally running SSH agent. An attacker who compromises or controls an SSH agent on the system can intercept or abuse this fallback to authenticate with keys the agent holds. The vulnerability affects curl versions 7.58.0 through 8.17.0 (with patch releases 8.14.2, 8.16.1, and 8.18.0 being unaffected). The issue is fixed in curl 8.18.0; as a workaround, users can rebuild curl with the libssh2 backend instead.

## Affected products

- curl curl 7.58.0 to 8.17.0, excluding 8.14.2, 8.16.1, and 8.18.0+

## Timeline

- 2026-01-07: disclosed: CVE-2025-15224 advisory published
- 2026-01-07: patched: curl 8.18.0 released with fix
- 2025-12-28: other: Vulnerability reported to curl project

## References

- [https://curl.se/docs/CVE-2025-15224.html](https://curl.se/docs/CVE-2025-15224.html)
- [https://curl.se/docs/CVE-2025-15224.json](https://curl.se/docs/CVE-2025-15224.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)