Is CVE-2026-8926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8926 being exploited in the wild.

How severe is CVE-2026-8926?

Informational severity, published 3 July 2026.

Which products and versions are affected?

curl curl 8.11.1 to 8.20.0; curl libcurl 8.11.1 to 8.20.0.

Is there a fix for CVE-2026-8926?

A patch was published on 2026-06-24: Fixed in curl 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8926 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8926?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8926: curl password leak in .netrc credential lookup

CVE-2026-8926 · Severity: info · Published 2026-07-03

A vulnerability in the curl data transfer tool could cause it to accidentally send the wrong password when connecting to a website. If a user provides a specific username in a web address but does not provide a password, curl may mistakenly pull a password belonging to a different user from the system's credential file (.netrc). This could lead to unauthorized access attempts or the unintended disclosure of sensitive login information to a server.

Quick answers

Is CVE-2026-8926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8926 being exploited in the wild.
How severe is CVE-2026-8926?: Informational severity, published 3 July 2026.
Which products and versions are affected?: curl curl 8.11.1 to 8.20.0; curl libcurl 8.11.1 to 8.20.0.
Is there a fix for CVE-2026-8926?: A patch was published on 2026-06-24: Fixed in curl 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8926 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8926?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A credential handling flaw exists in curl and libcurl (versions 8.11.1 through 8.20.0) when using .netrc files for authentication. If a URL includes a username but no password (e.g., https://user@example.com/) and the .netrc file does not contain a match for that specific user, curl may incorrectly select and transmit the password of a different user defined for the same host in the .netrc file. This is classified as CWE-522 (Insufficiently Protected Credentials). The issue was introduced in version 8.11.1 and is resolved in version 8.21.0. Users are advised to upgrade or avoid using .netrc for sensitive authentication data.

Affected products

curl curl 8.11.1 to 8.20.0
curl libcurl 8.11.1 to 8.20.0

Timeline

2026-05-14: disclosed: Reported to the curl project
2026-06-17: other: Contacted distros@openwall
2026-06-24: patched: Fixed in curl 8.21.0
2026-06-24: advisory: Project curl advisory published
2026-07-03: other: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.