CVE-2026-19931: Haxx Curl Auth Bypass Vulnerability

CVE-2026-19931 Overview

A flaw in libcurl causes it to wrongly reuse an HTTP connection previously authenticated with Negotiate (SPNEGO/Kerberos) when the initial request used empty credentials. When the connection is reused for a subsequent request from a different user, that request is transmitted over the connection already authenticated as another user. The result is that user B's HTTP request travels over user A's authenticated session, breaking the intended identity boundary between requests. This vulnerability is tracked under CWE-488: Exposure of Data Element to Wrong Session.

Critical Impact
Requests from one user can be sent over another user's authenticated Negotiate connection, enabling authentication context confusion and potential unauthorized access to protected HTTP resources.

Affected Products

Haxx curl (command-line tool)
Haxx libcurl (client library)
Applications and language bindings that link against affected libcurl versions and use Negotiate authentication

Discovery Timeline

2026-09-06 - CVE-2026-19931 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-19931

Vulnerability Analysis

The defect resides in libcurl's connection reuse logic for HTTP Negotiate authentication. Negotiate authentication binds identity to the underlying TCP connection rather than to individual HTTP requests. When libcurl performs an initial request with empty credentials, its internal connection cache does not correctly account for the authentication state that later becomes attached to that connection. A subsequent request targeting the same hostname is matched against the cached connection and reused, even when the requesting user identity differs. The reused connection carries the prior Negotiate authentication context, so the server treats the new request as though it originated from the previously authenticated principal.

Root Cause

The root cause is an incorrect key comparison in the connection pool. libcurl treats an initial request made with empty credentials as equivalent to any later request to the same host, ignoring the Negotiate authentication state that becomes bound to that connection after the handshake completes. This falls under CWE-488, where session-bound data is exposed to a different session.

Attack Vector

The vulnerability is reachable in multi-tenant or multi-user contexts that share a single libcurl handle or connection cache. Long-running services such as proxies, orchestrators, CI runners, and language runtimes that pool HTTP connections across users are the most exposed. An adversary who can trigger requests through the same shared client can have their traffic transmitted over a connection already authenticated as a higher-privileged user. Refer to the cURL CVE-2026-19931 Advisory and HackerOne Report #3923520 for the vendor's technical description.

Detection Methods for CVE-2026-19931

Indicators of Compromise

HTTP server access logs showing authenticated Negotiate requests attributed to a user whose client did not initiate that specific request.
Application logs where the authenticated principal on the server side does not match the user context that issued the outbound libcurl call.
Unexpected reuse of a single upstream TCP connection across requests originating from distinct user sessions in a shared service.

Detection Strategies

Inventory all deployed curl and libcurl versions across servers, containers, and application dependencies, then cross-reference against the fixed versions listed in the vendor advisory.
Identify services that combine Negotiate/SPNEGO authentication with shared or pooled libcurl handles, since these are the exploitable configurations.
Correlate server-side Kerberos authentication events with client-side request initiators to detect identity mismatches on shared connections.

Monitoring Recommendations

Enable verbose HTTP request logging on services that broker requests through libcurl so client identity can be reconciled with server-authenticated identity.
Monitor Kerberos ticket usage on origin servers for anomalies where a single service principal is used against unexpected resources.
Alert on repeated reuse of the same outbound TCP connection across distinct authenticated user contexts within shared HTTP clients.

How to Mitigate CVE-2026-19931

Immediate Actions Required

Upgrade curl and libcurl to the fixed version identified in the cURL CVE-2026-19931 Advisory on all affected hosts.
Rebuild and redeploy applications that statically link libcurl or ship it as a bundled dependency.
Audit shared services that use Negotiate authentication with pooled connections and rotate any credentials that may have been exposed across user boundaries.

Patch Information

The curl project has published fixed releases and a detailed technical description in the cURL CVE-2026-19931 Advisory and the machine-readable cURL CVE-2026-19931 JSON Data. Additional context on reporter findings is available in HackerOne Report #3923520. Distribution maintainers are backporting the fix; apply vendor updates as soon as they are available.

Workarounds

Disable HTTP Negotiate authentication in affected clients until patches are applied by removing the CURLAUTH_NEGOTIATE flag from CURLOPT_HTTPAUTH.
Force a new connection per request by setting CURLOPT_FRESH_CONNECT to 1L and CURLOPT_FORBID_REUSE to 1L on shared handles.
Isolate libcurl handles per user or per authentication context so no connection cache is shared across identity boundaries.

bash

# Configuration example: disable connection reuse for shared libcurl clients
# In application code using libcurl
curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);

# Verify installed curl version after patching
curl --version