Quick answers
- Is CVE-2026-86413 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86413 being exploited in the wild.
- How severe is CVE-2026-86413?
- Informational severity, published 20 October 2026.
- Which products and versions are affected?
- Curl 8.21.0 to 8.22.0.
- Is there a fix for CVE-2026-86413?
- Yes: fixed in 8.23.0. Until then: Do not use ambient user authentication with redirect following, or configure curl to disallow usernames in URLs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86413 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-86413?
- Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 8.23.0
Do not use ambient user authentication with redirect following, or configure curl to disallow usernames in URLs.
Technical details
The vulnerability occurs when curl uses ambient user credentials (obtained from the Kerberos system via a blank username) for Negotiate authentication on an initial request, then follows a redirect to a URL containing embedded credentials (e.g., https://user:pass@evil.example/). The flaw allows credential data from the first transfer to be sent to the second origin. This requires explicit redirect following and is mitigated if curl is configured to disallow embedded usernames in URLs.
Affected products
- curl curl 8.21.0 to 8.22.0
Timeline
- 2026-09-03: disclosed: Issue reported to curl project
- 2026-10-14: patched: curl 8.23.0 released with fix
- 2026-10-14: advisory