Is CVE-2026-86410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86410 being exploited in the wild.

How severe is CVE-2026-86410?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.81.0 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2.

How is CVE-2026-86410 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86410?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86410: curl redirect to SFTP or SCP bypasses host verification

CVE-2026-86410 · Severity: info · Published 2026-10-20

curl is a command-line tool used to transfer data over networks using URLs. When a curl user follows a redirect from HTTPS to SFTP or SCP, the tool fails to apply SSH host verification settings like known hosts checks. An attacker redirecting traffic to a malicious SSH server could intercept credentials or establish a man-in-the-middle connection without the user's intended security checks.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-86410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86410 being exploited in the wild.
How severe is CVE-2026-86410?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.81.0 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2.
Is there a fix for CVE-2026-86410?: Yes: fixed in curl 8.23.0, 8.20.2, 8.16.2, 8.14.3. Until then: Do not allow redirects to SFTP or SCP by avoiding the --location and --proto-redir +sftp options together, or restrict which protocols can be the target of redirects.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-08-27", "note": "Issue reported to curl project"}, {"kind": "patched", "at": "2026-10-14", "note": "curl 8.23.0 released with fix"}, {"kind": "advisory", "at": "2026-10-14", "note": "Security advisory published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86410 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86410?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2, 8.16.2, 8.14.3

Do not allow redirects to SFTP or SCP by avoiding the --location and --proto-redir +sftp options together, or restrict which protocols can be the target of redirects.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-08-27", "note": "Issue reported to curl project"}, {"kind": "patched", "at": "2026-10-14", "note": "curl 8.23.0 released with fix"}, {"kind": "advisory", "at": "2026-10-14", "note": "Security advisory published"}]

Technical details

The curl command-line tool fails to enforce SSH host verification options (--knownhosts, --hostpubsha256, --hostpubmd5) when a redirect from HTTPS to SFTP/SCP occurs, even when --location and --proto-redir +sftp are used. This is a host validation bypass (CWE-297) affecting the command-line tool only, not libcurl. The vulnerability requires user interaction with a redirect and explicit protocol redirection settings.

Affected products

curl curl 7.81.0 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.