CVE-2026-94265 in curl
Summary
by MITRE • 10/21/2026
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability in question represents a critical flaw in how curl handles HTTP redirects when they involve URLs containing userinfo components. Specifically, during the processing of such redirects, curl erroneously retains and re-transmits the original host's HTTP Negotiate authentication state. This behavior is particularly dangerous because it allows a malicious server to trigger a redirect that includes arbitrary userinfo, thereby forcing curl to send a freshly minted Kerberos ticket generated using the ambient identity of the client process to an untrusted third-party host.
This issue effectively bypasses the domain-scoping restrictions normally enforced by the absence of the --location-trusted flag. Under normal circumstances, curl restricts authentication credentials to the original target host or its subdomains unless explicitly instructed otherwise via specific command-line options. However, this flaw allows attackers to exploit the redirect mechanism to leak sensitive Kerberos tickets to external entities that should not have access to them.
From a technical perspective, the root cause lies in how curl manages and propagates authentication states across redirects involving userinfo components. When a server responds with an HTTP redirect status code (such as 301 or 302) pointing to a URL containing username and password information, curl incorrectly associates this new context with the previous Negotiate session. As a result, it generates and transmits Kerberos tickets intended for the original domain but sends them to the maliciously specified third-party host instead.
The operational impact of this vulnerability is severe. Attackers can exploit this flaw to steal valid Kerberos tickets from users who are authenticated within an Active Directory environment. These stolen tickets can then be used in pass-the-ticket attacks, allowing unauthorized access to resources protected by those credentials. This undermines the security model provided by Kerberos authentication and exposes organizations to significant risks including data exfiltration, lateral movement, and privilege escalation.
This vulnerability aligns with CWE-200: Information Exposure, as it leads to the unintended disclosure of sensitive authentication material. Additionally, from an ATT&CK perspective, this behavior facilitates techniques such as T1558: Steal or Forge Kerberos Tickets, where adversaries capture valid tickets for later use in accessing network resources without needing to crack passwords directly.
Mitigation strategies should focus on ensuring that curl strictly adheres to domain-scoping rules when handling redirects with userinfo components. Developers must review the logic governing authentication state propagation and ensure that credentials are never transmitted outside their intended scope unless explicitly permitted by configuration settings like --location-trusted. Users affected by this vulnerability should update to a patched version of curl as soon as possible. In environments where immediate patching is not feasible, network-level controls such as strict proxy configurations or firewall rules limiting outbound authentication traffic can provide temporary protection against exploitation attempts.