Is CVE-2026-87861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87861 being exploited in the wild.

How severe is CVE-2026-87861?

Informational severity, published 20 October 2026.

Is there a fix for CVE-2026-87861?

Yes: fixed in curl 8.23.0. Until then: Avoid using ambient users for authentication, or upgrade to curl 8.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87861 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87861?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87861: curl cross-origin reuse of Negotiate connection

CVE-2026-87861 · Severity: info · Published 2026-10-20

curl is a widely-used tool for transferring data with URLs, used by many applications and scripts. When using automatic authentication credentials, a request to one website may be sent over an existing connection that was previously authenticated for a different website, potentially exposing the original request to unintended access. This could allow an attacker to intercept or misuse authentication tokens across different origins.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-87861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87861 being exploited in the wild.
How severe is CVE-2026-87861?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.21.0 to 8.22.0.
Is there a fix for CVE-2026-87861?: Yes: fixed in curl 8.23.0. Until then: Avoid using ambient users for authentication, or upgrade to curl 8.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87861 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87861?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0

Avoid using ambient users for authentication, or upgrade to curl 8.23.0 or later.

Technical details

An HTTP request targeting one origin may be dispatched over a connection previously authenticated via HTTP Negotiate authentication for a different origin. This occurs when ambient credentials (blank username with OS-level identity) are used, leaving the intended credentials unused and exposing authentication state reuse across origins. The vulnerability is a connection reuse logic flaw (CWE-201: Information Exposure Through Sent Data) affecting versions 8.21.0 through 8.22.0.

Affected products

curl curl 8.21.0 to 8.22.0

Timeline

2026-08-26: disclosed: Issue reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix
2026-10-14: advisory: CVE-2026-87861 advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.