CVE-2026-86413 in curl
Summary
by MITRE • 10/20/2026
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described involves a critical flaw in how the libcurl library handles HTTP redirections during Negotiate authentication sequences, specifically affecting sessions established with ambient user credentials. In modern web architectures and API interactions, it is common for servers to respond to initial requests with status codes indicating that the resource has moved or requires further processing via a different URL. When curl encounters such redirects, particularly those involving cross-origin transitions, it must decide whether to preserve existing authentication context or reset security boundaries. The flaw arises when an ambient user credential mechanism is active during a Negotiate authentication handshake and the client is instructed to follow a redirect to a distinct origin that was not part of the initial authenticated session.
Negotiate authentication typically relies on protocols like Kerberos or NTLM, which are designed to provide strong mutual authentication without transmitting passwords in plaintext. However, these mechanisms often involve complex state machines where credentials are cached and reused for subsequent requests within a trusted context. The technical flaw occurs because curl incorrectly propagates the credential details obtained from the first origin to the second, unrelated origin during the redirect process. This behavior violates fundamental security principles regarding cross-origin isolation, as it assumes that authentication tokens or negotiated secrets established for one service should be valid and transmitted to another entirely separate entity.
From a technical perspective, this issue stems from an improper implementation of credential scope management within the redirection logic. When curl processes a redirect response, it checks whether existing credentials can be reused based on host matching rules. In this specific scenario involving ambient users and Negotiate auth, these checks fail to adequately distinguish between the original target origin and the redirected destination if they differ in scheme, host, or port. Consequently, sensitive authentication headers containing Kerberos tickets or NTLM challenge-response data are included in requests directed at the new, unrelated server. This effectively bypasses intended access controls that rely on strict origin binding for authenticated sessions.
The operational impact of this vulnerability is severe, primarily centering on unauthorized information disclosure and potential privilege escalation across service boundaries. An attacker controlling or influencing the redirect target could trick a user agent into sending valid authentication credentials to their malicious server. If these Negotiate tokens are replayable or if they grant access to backend resources that trust the originating domain but not necessarily the intermediate proxy, the attacker may gain unauthorized access to sensitive data or administrative functions. Furthermore, in enterprise environments where single sign-on is prevalent, this flaw could allow an adversary to harvest Kerberos tickets for offline cracking or relay attacks against other services within the same Active Directory forest, significantly expanding the attack surface beyond the initially targeted application.
This behavior aligns with CWE-200: Information Exposure and CWE-359: Exposure of Private Personal Information to Unauthorized Actors, as it results in the unintended leakage of authentication material. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques related to Credential Access, specifically T1078: Valid Accounts or potentially T1556: Modifying Authentication Process if the redirect is part of a phishing chain designed to capture tokens. It also touches upon cross-site request forgery dynamics where authenticated states are exploited across different contexts without proper validation.
Mitigation strategies must focus on strict enforcement of origin-based credential scoping. Developers and system administrators should ensure that curl implementations enforce same-origin policies for authentication headers during redirects, ensuring that Negotiate credentials are only sent to the exact host they were originally negotiated with unless explicitly configured otherwise through secure proxy settings or explicit allow-lists. Upgrading to patched versions of libcurl is essential, as these updates typically include stricter checks on redirect targets before reusing cached credentials. Additionally, security teams should audit applications using curl for any custom redirection logic that might override default safe behaviors and implement Content Security Policy headers where applicable to limit the impact of potential credential leakage in browser-based contexts utilizing similar libraries.