CVE-2026-86413 - Vulnerability Details - OpenCVE

A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-86413
https://www.cve.org/CVERecord?id=CVE-2026-86413

History

Sat, 17 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data.
Title		curl: curl: Negotiate credentials sent to redirected origin
Weaknesses		CWE-201
References		https://nvd.nist.gov/vuln/detail/CVE-2026-86413 https://www.cve.org/CVERecord?id=CVE-2026-86413
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}` threat_severity `Low`

Projects

Sign in to view the affected projects.

MITRE

No data.

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-10-14T12:00:00Z

Links: CVE-2026-86413 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-17T02:00:07Z

Weaknesses

CWE-201

{"acknowledgement": "Red Hat would like to thank Stanislav Fort (Aisle Research) for reporting this issue.", "bugzilla": {"description": "curl: curl: Negotiate credentials sent to redirected origin", "id": "2550594", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550594"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data."], "name": "CVE-2026-86413", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Not affected", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86413\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86413"], "statement": "Red Hat rates this vulnerability as Low impact because successful credential exposure requires an uncommon combination of conditions: an HTTP request using Negotiate authentication with ambient Kerberos credentials must be configured to follow redirects to a secondary URL with embedded credentials. Furthermore, core Red Hat Enterprise Linux distributions ship curl versions outside the affected upstream release window. In typical enterprise environments, Kerberos-authenticated transfers rarely follow automated redirects across disparate origins, significantly limiting exposure in practice.", "threat_severity": "Low"}