CVE-2026-87861 in curl
Summary
by MITRE • 10/21/2026
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
This vulnerability pertains to a critical flaw in how web browsers handle authentication contexts and network connections when dealing with mixed-origin requests using ambient user credentials such as Kerberos or NTLM tokens. The core issue arises from connection reuse mechanisms inherent in modern HTTP clients, which aim to optimize performance by reusing established TCP connections for multiple requests. When an application initiates a request to one origin that requires Negotiate authentication, the browser establishes a secure channel and authenticates with the target server using the user's ambient credentials. Subsequently, if another request is made to a different origin but shares the same underlying network endpoint or connection pool characteristics, the browser may incorrectly route this new request over the existing authenticated connection intended for the first origin.
The technical flaw lies in the failure of the HTTP client implementation to strictly isolate authentication contexts based on origin boundaries before reusing connections. In standard web security models, credentials should be scoped tightly to specific origins or at least distinct service principals to prevent credential leakage and unauthorized access. However, due to this oversight, the request directed toward the second origin is dispatched using the connection authenticated for the first origin. Consequently, the intended ambient credentials associated with the second origin remain unused, while the credentials of the first origin are inadvertently exposed to a potentially untrusted or different service context. This behavior violates the principle of least privilege and breaks the expected isolation between distinct web origins.
From an operational impact perspective, this vulnerability can lead to significant security breaches including unauthorized access to resources on the second origin using privileges granted for the first origin. If the two origins have differing trust levels or permission sets, an attacker could exploit this misrouting to escalate privileges or access sensitive data that should not be accessible via the current context. Furthermore, it may result in authentication failures if the server at the second origin rejects credentials issued by a different principal than expected, leading to denial of service for legitimate users attempting to interact with services across multiple domains within an enterprise environment relying on single sign-on mechanisms like Kerberos delegation or integrated Windows authentication.
This issue aligns closely with CWE-200: Information Exposure and CWE-798: Use of Hard-coded Credentials in the context of improper credential scoping, as well as ATT&CK technique T1556: Modifying Authentication Process where an adversary might manipulate authentication flows to bypass controls. The vulnerability highlights a gap in enforcing strict origin-based isolation for authenticated connections, which is essential for maintaining integrity in multi-tenant or cross-domain web applications.
Mitigation strategies must focus on ensuring that HTTP clients strictly enforce connection boundaries based on the target origin and service principal name rather than relying solely on network-level connection reuse optimizations. Developers should configure their application frameworks to disable aggressive connection pooling across different origins unless explicitly verified as safe by security policies. Additionally, implementing strict Content Security Policy headers and verifying server-side authentication token validation against expected principals can help detect anomalous access patterns. Browser vendors must also address this at the engine level by ensuring that negotiated authentication contexts are invalidated or isolated when switching between distinct origins to prevent cross-origin credential leakage through shared transport layers.