Is CVE-2026-87865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87865 being exploited in the wild.

How severe is CVE-2026-87865?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.69.1 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2, and 8.23.0+.

How is CVE-2026-87865 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87865?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87865: curl libssh2 host key validation bypass with hashed known_hosts

CVE-2026-87865 · Severity: info · Published 2026-10-20

curl is a widely-used library and command-line tool for transferring data over networks, including secure shell (SSH) connections. When using SSH with a hashed known_hosts file, curl may incorrectly report a legitimate host key mismatch as a missing key to custom validation callbacks, allowing a network attacker controlling an SSH endpoint to impersonate a trusted host. This could lead to credential disclosure and unauthorized data access.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-87865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87865 being exploited in the wild.
How severe is CVE-2026-87865?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.69.1 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2, and 8.23.0+.
Is there a fix for CVE-2026-87865?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Avoid the libssh2 backend for SFTP and SCP transfers, or upgrade to a patched version. Applications can also implement additional host key pinning or validation logic outside of the SSH key callback. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87865 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87865?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Avoid the libssh2 backend for SFTP and SCP transfers, or upgrade to a patched version. Applications can also implement additional host key pinning or validation logic outside of the SSH key callback.

Technical details

When libcurl uses the libssh2 backend for SFTP/SCP transfers with a hashed known_hosts file, an unrelated initial entry can cause the host key validation logic to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This allows a network attacker who controls or intercepts the reached SSH endpoint to make a pinned host appear genuinely new to trust-on-first-use callbacks. The default callback and curl command-line tool are not affected; only applications using custom SSH key validation callbacks with the libssh2 backend are vulnerable.

Affected products

curl curl 7.69.1 to 8.22.0, excluding 8.14.3, 8.16.2, 8.20.2, and 8.23.0+

Timeline

2026-08-28: disclosed: Vulnerability reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix
2026-10-14: advisory: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.