CVE-2026-86414

leaking host credentials to HTTP proxy

View on CVE.org
Published Oct 20, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8932-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Type Values Removed Values Added
Description A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens. An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
Title curl: curl: leaking host credentials to HTTP proxy leaking host credentials to HTTP proxy
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens.
Title curl: curl: leaking host credentials to HTTP proxy
Weaknesses CWE-201
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Low
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Oct 30, 2026, 11:47 AM
Reserved
Sep 7, 2026, 12:11 PM

View source JSON

Updated
Oct 30, 2026, 11:46 AM

JSON

Status
Awaiting Analysis
Published
Oct 20, 2026, 9:17 PM
Modified
Oct 30, 2026, 12:16 PM

View source JSON

Severity
Low
Public date
Oct 14, 2026, 12:00 PM

View source Bugzilla JSON

Updated
Oct 30, 2026, 2:15 PM

JSON