# CVE-2026-9547: curl libcurl improper host validation in SSH key callback

Source: https://junglewise.ai/threats/cve-2026-9547-curl-libcurl-improper-host-validation-in-ssh-key-callback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-9547 · Severity: info · CVSS 0 · Published 2026-07-03

A security flaw in the libcurl library could allow an attacker to intercept or modify data during secure file transfers (SCP or SFTP). The library may fail to verify the identity of a server if the server uses a different type of security key than what was previously recorded. This could lead to a man-in-the-middle attack where an unauthorized party impersonates a trusted server without the application noticing.

## Quick answers

**Is CVE-2026-9547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9547 being exploited in the wild.

**How severe is CVE-2026-9547?** Informational severity, with a CVSS score of 0, published 3 July 2026.

**Which products and versions are affected?** curl curl 7.69.0 to 8.20.0.

**Is there a fix for CVE-2026-9547?** A patch was published on 2026-06-24: Fixed in curl 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9547 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9547?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libcurl when built with the libssh backend (libssh2 is unaffected) during SCP or SFTP transfers. When an application utilizes the CURLOPT_SSH_KEYFUNCTION callback, the library may fail to properly enforce host key restrictions if the server presents a key type that differs from the one stored in the known_hosts file for that host. Instead of rejecting the mismatch, the callback mechanism allows the connection to proceed, enabling potential man-in-the-middle (MITM) attacks. This issue does not affect the curl command-line tool and is fixed in version 8.21.0.

## Affected products

- curl curl 7.69.0 to 8.20.0

## Timeline

- 2026-05-20: disclosed: Reported to the curl project
- 2026-06-24: patched: Fixed in curl 8.21.0
- 2026-06-24: advisory: Project curl advisory published

## References

- [https://curl.se/docs/CVE-2026-9547.html](https://curl.se/docs/CVE-2026-9547.html)
- [https://curl.se/docs/CVE-2026-9547.json](https://curl.se/docs/CVE-2026-9547.json)
- [https://hackerone.com/reports/3751712](https://hackerone.com/reports/3751712)