Is CVE-2026-86409 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86409 being exploited in the wild.

How severe is CVE-2026-86409?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.75.0 to 8.21.0 (except 8.14.3, 8.16.2, 8.20.2).

How is CVE-2026-86409 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86409?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86409: curl stale SigV4 headers sent unintended

CVE-2026-86409 · Severity: info · Published 2026-10-20

curl is a widely-used library and command-line tool for transferring data with URLs. When an application reuses a curl connection handle after attempting to disable AWS SigV4 authentication, the library incorrectly continues to send signed Authorization headers to subsequent requests, potentially leaking the access-key identifier and cryptographic signature to an attacker-controlled server.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-86409 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86409 being exploited in the wild.
How severe is CVE-2026-86409?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.75.0 to 8.21.0 (except 8.14.3, 8.16.2, 8.20.2).
Is there a fix for CVE-2026-86409?: Yes: fixed in curl 8.22.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Do not attempt to NULL the CURLOPT_AWS_SIGV4 option when reusing handles; instead, create a fresh handle for requests that should not use SigV4 authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86409 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86409?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.22.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Do not attempt to NULL the CURLOPT_AWS_SIGV4 option when reusing handles; instead, create a fresh handle for requests that should not use SigV4 authentication.

Technical details

Setting CURLOPT_AWS_SIGV4 to NULL fails to disable SigV4 authentication; subsequent transfers on the same handle still send AWS4-HMAC-SHA256 Authorization headers, contrary to documented behavior. The vulnerability requires an application that reuses handles, retains USERPWD credentials, relies on the NULL reset mechanism, and issues a request to an attacker-influenced URL. An attacker gains the access-key identifier and request-bound signature (but not the secret key); this is classified as information exposure through sent data (CWE-201).

Affected products

curl curl 7.75.0 to 8.21.0 (except 8.14.3, 8.16.2, 8.20.2)

Timeline

2026-08-27: disclosed
2026-09-02: patched
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.