PT-2026-113745

CVE-2026-87861

Published

2026-10-14

Updated

2026-11-03

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1

Description When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin. This behavior results in the intended credentials for the request remaining unused.

Recommendations Update to version 8.23.0-1.1.

Exploitability

Exploit

Fix

Researchers

Axel Mierczuk

Stefan Eissing

Vendors

Affected products

Weakness enumeration

CWE-201: Insertion of Sensitive Information Into Sent Data

Related identifiers