CVE-2026-86409

HighCVSS 8.1/10Last modified Oct 29, 2026

Description

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-201

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
curl	curl	>= 8.21.0, <= 8.21.0; >= 8.20.0, <= 8.20.0; >= 8.19.0, <= 8.19.0; >= 8.18.0, <= 8.18.0; >= 8.17.0, <= 8.17.0; >= 8.16.0, <= 8.16.0; >= 8.15.0, <= 8.15.0; >= 8.14.1, <= 8.14.1; >= 8.14.0, <= 8.14.0; >= 8.13.0, <= 8.13.0; >= 8.12.1, <= 8.12.1; >= 8.12.0, <= 8.12.0; >= 8.11.1, <= 8.11.1; >= 8.11.0, <= 8.11.0; >= 8.10.1, <= 8.10.1; >= 8.10.0, <= 8.10.0; >= 8.9.1, <= 8.9.1; >= 8.9.0, <= 8.9.0; >= 8.8.0, <= 8.8.0; >= 8.7.1, <= 8.7.1

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-864108.1A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an CVE-2026-864119.1An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-864128.1A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-864139.1When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its creden CVE-2026-864149.1An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-864157.5libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann CVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and CVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetc CVE-2026-864184.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restri CVE-2026-864199.1Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fu CVE-2026-86424.3IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information CVE-2026-864207.5ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated