Is CVE-2026-94265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94265 being exploited in the wild.

How severe is CVE-2026-94265?

Informational severity, published 20 October 2026.

Is there a fix for CVE-2026-94265?

Yes: fixed in curl 8.23.0. Until then: Do not follow redirects when using HTTP Negotiate authentication, or upgrade to curl 8.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94265 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94265?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94265: curl Negotiate authentication credential exposure on redirect

CVE-2026-94265 · Severity: info · Published 2026-10-20

curl is a widely-used command-line tool and library for transferring data over the network. When following HTTP redirects, curl can be tricked into sending Kerberos authentication credentials (generated using the user's identity) to an untrusted third-party server, potentially allowing an attacker to impersonate the user on other systems. This bypasses the normal security restrictions that prevent credentials from being sent to foreign hosts.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-94265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94265 being exploited in the wild.
How severe is CVE-2026-94265?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.21.0 to 8.22.0.
Is there a fix for CVE-2026-94265?: Yes: fixed in curl 8.23.0. Until then: Do not follow redirects when using HTTP Negotiate authentication, or upgrade to curl 8.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94265 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94265?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0

Do not follow redirects when using HTTP Negotiate authentication, or upgrade to curl 8.23.0 or later.

Technical details

A malicious server can trigger an HTTP redirect containing userinfo (username:password in the URL) that causes curl to retain and re-transmit the original host's HTTP Negotiate (Kerberos) authentication state to the redirect target. The vulnerability affects curl versions 8.21.0 through 8.22.0 and requires the user to follow redirects (which is common behavior). An attacker gains the ability to obtain a Kerberos ticket scoped to the user's ambient identity and forward it to a foreign origin, circumventing domain-scoping protections.

Affected products

curl curl 8.21.0 to 8.22.0

Timeline

2026-10-14: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.