# CVE-2026-86413: curl Negotiate authentication credential leakage on redirects

Source: https://junglewise.ai/threats/cve-2026-86413-when-using-an-ambient-user-in-a-first-transfer-doing-negotiate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-86413 · Severity: info · Published 2026-10-20

curl is a widely-used library and tool for transferring data via URLs. When using Negotiate (Kerberos) authentication with an ambient user and following HTTP redirects, curl could inadvertently send authentication credentials to an unrelated destination server. This could allow an attacker to harvest credentials if they control a redirect target URL.

Technologies: [Curl](https://junglewise.ai/threats/technologies/curl-curl). Vendors: [Curl](https://junglewise.ai/threats/vendors/curl).

## Quick answers

**Is CVE-2026-86413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86413 being exploited in the wild.

**How severe is CVE-2026-86413?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Curl 8.21.0 to 8.22.0.

**Is there a fix for CVE-2026-86413?** Yes: fixed in 8.23.0. Until then: Do not use ambient user authentication with redirect following, or configure curl to disallow usernames in URLs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86413 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86413?** Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.23.0

Do not use ambient user authentication with redirect following, or configure curl to disallow usernames in URLs.

## Technical details

The vulnerability occurs when curl uses ambient user credentials (obtained from the Kerberos system via a blank username) for Negotiate authentication on an initial request, then follows a redirect to a URL containing embedded credentials (e.g., https://user:pass@evil.example/). The flaw allows credential data from the first transfer to be sent to the second origin. This requires explicit redirect following and is mitigated if curl is configured to disallow embedded usernames in URLs.

## Affected products

- curl curl 8.21.0 to 8.22.0

## Timeline

- 2026-09-03: disclosed: Issue reported to curl project
- 2026-10-14: patched: curl 8.23.0 released with fix
- 2026-10-14: advisory

## References

- [https://curl.se/docs/CVE-2026-86413.html](https://curl.se/docs/CVE-2026-86413.html)
- [https://curl.se/docs/CVE-2026-86413.json](https://curl.se/docs/CVE-2026-86413.json)

## Related threats

- [libcurl credentials leak in CURLINFO_EFFECTIVE_URL](https://junglewise.ai/threats/cve-2026-94266-libcurl-could-accidentally-return-a-url-for-curl-easy-getinfo-s)
- [curl Negotiate authentication credential exposure on redirect](https://junglewise.ai/threats/cve-2026-94265-when-processing-an-http-redirect-to-a-url-containing-userinfo-a)
- [curl stack overflow in MIME structure cleanup](https://junglewise.ai/threats/cve-2026-92391-a-deeply-nested-multipart-mime-structure-constructed-via-the)
- [curl remote-header-name file overwrite bypass](https://junglewise.ai/threats/cve-2026-92390-when-invoked-with-remote-header-name-j-curl-fails-to-preserve-its)
- [curl infinite loop via server response omission](https://junglewise.ai/threats/cve-2026-92387-by-permanently-omitting-the-final-control-response-line-a)