Is CVE-2026-86414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86414 being exploited in the wild.

How severe is CVE-2026-86414?

Informational severity, published 20 October 2026.

Is there a fix for CVE-2026-86414?

Yes: fixed in curl 8.23.0, 8.20.2, 8.16.2, 8.14.3. Until then: Avoid using HTTP proxies, or upgrade to a patched version of curl. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86414 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-86414?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86414: curl credential leak to HTTP proxy

CVE-2026-86414 · Severity: info · Published 2026-10-20

curl, a widely used tool for transferring data over networks, can be tricked by a malicious HTTP proxy into sending authentication credentials (passwords or Kerberos tickets) intended for the origin server directly to the proxy itself. An attacker controlling a proxy on the network path could intercept these credentials and use them to authenticate as the legitimate user to the origin server.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-86414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86414 being exploited in the wild.
How severe is CVE-2026-86414?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.10.8 to 8.22.0.
Is there a fix for CVE-2026-86414?: Yes: fixed in curl 8.23.0, 8.20.2, 8.16.2, 8.14.3. Until then: Avoid using HTTP proxies, or upgrade to a patched version of curl. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86414 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-86414?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2, 8.16.2, 8.14.3

Avoid using HTTP proxies, or upgrade to a patched version of curl.

Technical details

A malicious HTTP proxy can respond to a CONNECT tunnel request with a 401 WWW-Authenticate header instead of the expected 407 Proxy-Authenticate header, causing libcurl to send origin authentication credentials to the proxy. This information disclosure affects curl versions 7.10.8 through 8.22.0 in multiple release branches and requires an attacker to position themselves as a network proxy. A fix was released in curl 8.23.0 and backported to 8.14.3, 8.16.2, and 8.20.2.

Affected products

curl curl 7.10.8 to 8.22.0

Timeline

2026-09-03: disclosed
2026-10-14: advisory
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.