Is CVE-2026-94266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94266 being exploited in the wild.

How severe is CVE-2026-94266?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.62.0 to 8.22.0; also 7.62.0 to 8.23.0 (7.62 through 8.22 line), with fixes in 8.14.3, 8.16.2, 8.20.2, and 8.23.0.

How is CVE-2026-94266 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-94266?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94266: libcurl credentials leak in CURLINFO_EFFECTIVE_URL

CVE-2026-94266 · Severity: info · Published 2026-10-20

libcurl is a widely used library for making network requests that is embedded in many applications. When retrieving credentials from a .netrc file, libcurl could accidentally return those credentials in the effective URL through the CURLINFO_EFFECTIVE_URL option, exposing them to applications that query this information even though the original request URL contained no credentials.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-94266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94266 being exploited in the wild.
How severe is CVE-2026-94266?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.62.0 to 8.22.0; also 7.62.0 to 8.23.0 (7.62 through 8.22 line), with fixes in 8.14.3, 8.16.2, 8.20.2, and 8.23.0.
Is there a fix for CVE-2026-94266?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Do not use CURLINFO_EFFECTIVE_URL if retrieving credentials from .netrc files, or restrict access to logging and debugging output that contains effective URLs returned by libcurl. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94266 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-94266?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Do not use CURLINFO_EFFECTIVE_URL if retrieving credentials from .netrc files, or restrict access to logging and debugging output that contains effective URLs returned by libcurl.

Technical details

libcurl inadvertently includes .netrc-sourced credentials in the returned effective URL from curl_easy_getinfo(CURLINFO_EFFECTIVE_URL), a credential exposure vulnerability (CWE-522). The issue affects versions 7.62.0 through 8.22.0 when credentials are loaded from .netrc files; an attacker with access to application logs or debugging output containing this information could retrieve credentials. A patch has been released in curl 8.23.0 and backported to earlier maintenance branches.

Affected products

curl curl 7.62.0 to 8.22.0; also 7.62.0 to 8.23.0 (7.62 through 8.22 line), with fixes in 8.14.3, 8.16.2, 8.20.2, and 8.23.0

Timeline

2026-09-18: disclosed: Issue reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.