CVE-2026-86413

CriticalCVSS 9.1/10Last modified Oct 30, 2026

Description

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-201

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-864149.1An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-864157.5libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated SchannCVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() andCVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetcCVE-2026-864184.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restriCVE-2026-864199.1Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fuCVE-2026-86424.3IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system informationCVE-2026-864207.5ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated CVE-2026-864217.5ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation wiCVE-2026-864223.3ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers tCVE-2026-864235.5ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A cCVE-2026-864242.5ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attac