CVE-2026-8926

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description When configured to use a .netrc file for credentials while simultaneously specifying a URL containing a username but no password (e.g., https://user@example.com/), the software may incorrectly retrieve and use the password of a different user defined in the .netrc file for that host, provided no match for the specified user exists.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.