> CVE-2026-8926

« BACK_TO_HOME
PUBLISHED
2026-07-03 07:16
MODIFIED
2026-07-03 07:16
EPSS (Prob. Exploit)
0.44%
Top 62.4%
DATA SOURCES:
NVD 🔗 2026-07-03 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://[email protected]/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CV...
Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulner...
Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update
Updated container image for Red Hat Cost Management On-Premise is now available.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

password leak with netrc and user in URL

AFFECTED PACKAGES:
Unknown / Unknown
36 versions affected
ALIASES:
CURL-CVE-2026-8926

> HISTORIQUE DES MODIFICATIONS

Première apparition
03/07/2026 07:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 4 months ago

> REFERENCES

https://curl.se/docs/CVE-2026-8926.html
https://curl.se/docs/CVE-2026-8926.json
https://hackerone.com/reports/3735184
« BACK_TO_HOME