Executive brief
libcurl is a widely-used library for making HTTP requests in applications across many industries. A flaw in Negotiate authentication (used for Windows domain authentication and Kerberos) allows libcurl to incorrectly reuse an authenticated connection between different users, potentially exposing one user's authenticated session to another user's requests. An attacker could exploit this in multi-user or multi-tenant environments to bypass authentication and access another user's data or perform actions as that user.
Technical details
The vulnerability exists in libcurl's Negotiate authentication connection pooling logic (CWE-488: Exposure of Data Element to Wrong Session). When using Negotiate authentication with empty credentials (treated as ambient user authentication via SSPI on Windows or GSSAPI on other systems), libcurl incorrectly reuses HTTP connections across different authenticated sessions. Because libcurl maintains credentials outside its direct control in ambient authentication scenarios, it cannot detect when the underlying ambient user changes; this allows a subsequent request from a different user to be sent over a previously authenticated connection. The vulnerability affects curl 7.64.1 through 8.21.0, with multiple patch points released. Network-reachable HTTP/HTTPS services using curl or libcurl with Negotiate authentication are vulnerable; exploitation requires only that the attacker can make HTTP requests. Patches are available in curl 8.22.0 and earlier patched versions (8.20.1, 8.16.1, 8.14.2).
Affected products
- curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries)
Timeline
- 2026-09-02: disclosed: Public advisory and curl 8.22.0 release
- 2026-09-02: patched: curl 8.22.0 released with fix
- 2026-08-07: other: Issue reported to curl project