CVE-2026-8926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8926", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-05-19T08:11:58.393Z", "datePublished": "2026-07-03T06:15:45.735Z", "dateUpdated": "2026-09-15T06:03:23.777Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:23.777Z"}, "title": "password leak with netrc and user in URL", "descriptions": [{"lang": "en", "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.11.1", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949", "status": "affected", "versionType": "git", "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-8926.json"}, {"url": "https://curl.se/docs/CVE-2026-8926.html"}, {"url": "https://hackerone.com/reports/3735184"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-8926", "aliases": ["CVE-2026-8926"], "summary": "password leak with netrc and user in URL", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-8926.json", "www": "https://curl.se/docs/CVE-2026-8926.html", "issue": "https://hackerone.com/reports/3735184", "CWE": {"id": "CWE-522", "desc": "Insufficiently Protected Credentials"}, "last_affected": "8.20.0", "severity": "Low"}, "published": "2026-06-24T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.11.1"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"}, {"fixed": "4ae1d7cc2643e4773a136395f12bc02fc6867854"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1"]}], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficiently Protected Credentials", "cweId": "CWE-522", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3735184", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T17:01:57.524535Z", "id": "CVE-2026-8926", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:02:33.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8926", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T17:01:57.524535Z"}}}], "references": [{"url": "https://hackerone.com/reports/3735184", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:02:29.139Z"}}], "cna": {"title": "password leak with netrc and user in URL", "x_osv": {"id": "CURL-CVE-2026-8926", "aliases": ["CVE-2026-8926"], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.", "summary": "password leak with netrc and user in URL", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.11.1"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"}, {"fixed": "4ae1d7cc2643e4773a136395f12bc02fc6867854"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-06-24T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-522", "desc": "Insufficiently Protected Credentials"}, "URL": "https://curl.se/docs/CVE-2026-8926.json", "www": "https://curl.se/docs/CVE-2026-8926.html", "issue": "https://hackerone.com/reports/3735184", "affects": "both", "package": "curl", "severity": "Low", "last_affected": "8.20.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Stefan Eissing"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.11.1", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949", "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-8926.json"}, {"url": "https://curl.se/docs/CVE-2026-8926.html"}, {"url": "https://hackerone.com/reports/3735184"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:23.777Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8926", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:03:23.777Z", "dateReserved": "2026-05-19T08:11:58.393Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-07-03T06:15:45.735Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "8.11.1", "versionType": "semver"}, {"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854", "status": "affected", "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3AD1A6E-F3DD-4151-9602-669ADAF00525", "versionEndExcluding": "8.21.0", "versionStartIncluding": "8.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}], "id": "CVE-2026-8926", "lastModified": "2026-09-15T07:16:32.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8926", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T17:01:57.524535Z", "version": "2.0.3"}}]}, "published": "2026-07-03T07:16:25.037", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-8926.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-8926.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3735184"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3735184"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "curl: curl: Information disclosure via incorrect .netrc password lookup", "id": "2496760", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496760"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-289", "details": ["When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.", "A flaw was found in curl. When curl is configured to use a .netrc file for credentials and a URL is provided with a username but no password, curl may incorrectly retrieve and use the password for a different user from the .netrc file for the same host. This could lead to unauthorized information disclosure, as curl might connect using unintended credentials."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-8926", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Fix deferred", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2026-07-03T06:15:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-8926\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8926\nhttps://curl.se/docs/CVE-2026-8926.html\nhttps://curl.se/docs/CVE-2026-8926.json\nhttps://hackerone.com/reports/3735184"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.17.0,8.17.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.16.0,8.16.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.15.0,8.15.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.1,8.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.0,8.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.13.0,8.13.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.1,8.12.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.0,8.12.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.1,8.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T07:45:03.410125+00:00", "updated": "2026-09-21T08:00:08.625483+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}