CVE-2026-86409: cURL AWS SigV4 Information Disclosure

CVE-2026-86409 Overview

CVE-2026-86409 affects the cURL library's handling of the CURLOPT_AWS_SIGV4 option. Setting this option to NULL does not disable AWS Signature Version 4 (SigV4) authentication, contrary to the documented behavior. A subsequent transfer reusing the same handle continues to send an Authorization: AWS4-HMAC-SHA256 header to whichever URL is configured next. This leaks authentication state to unrelated endpoints and can expose credentials or sensitive signing material to hosts that were never intended to receive AWS authentication data.

Critical Impact
Reused cURL handles can transmit SigV4 authorization headers to arbitrary URLs after the caller believed SigV4 was disabled, leaking authentication state to unintended destinations.

Affected Products

cURL library (libcurl) — refer to the cURL CVE-2026-86409 Documentation for affected version ranges
Applications linking libcurl and reusing easy handles across transfers
Tooling that programmatically toggles CURLOPT_AWS_SIGV4 between requests

Discovery Timeline

2026-10-20 - CVE-2026-86409 published to NVD
2026-10-22 - Last updated in NVD database
Additional disclosure context is available in HackerOne Report #3973135

Technical Details for CVE-2026-86409

Vulnerability Analysis

The flaw is an information disclosure issue rooted in incorrect option-reset semantics inside libcurl. The CURLOPT_AWS_SIGV4 option enables AWS SigV4 request signing for a transfer. According to cURL documentation, passing NULL to this option should disable SigV4 for subsequent transfers on the same easy handle. The implementation does not clear the internal SigV4 state when NULL is supplied. Any later transfer performed on that handle continues to apply SigV4 signing and emits an Authorization: AWS4-HMAC-SHA256 header toward the new target URL.

Because the destination URL may belong to a different service or host, authentication material intended for an AWS endpoint can be transmitted to an unrelated server. This exposes the signed Authorization header, signed headers list, and derived request metadata to a party that was not intended to receive them.

Root Cause

The root cause is improper option teardown. The option setter accepts NULL without releasing or zeroing the stored SigV4 provider state, so the signing path remains active on the handle. The documented contract and the implemented behavior diverge, producing an unexpected state carry-over between transfers.

Attack Vector

Exploitation does not require a remote attacker to reach the client. The vulnerable condition is triggered by application code that reuses a cURL handle, disables SigV4 by assigning NULL, and issues a new request to a non-AWS URL. An attacker who controls or observes the second URL — for example a redirect target, a user-supplied destination, or a logging endpoint — receives the SigV4 Authorization header and associated signed metadata. The vulnerability description does not list a CWE identifier.

No verified exploit code is published for this issue. Technical details are documented in the cURL CVE-2026-86409 Documentation and the cURL CVE-2026-86409 JSON Details.

Detection Methods for CVE-2026-86409

Indicators of Compromise

Outbound HTTP requests to non-AWS hosts carrying an Authorization: AWS4-HMAC-SHA256 header
x-amz-date, x-amz-content-sha256, or x-amz-security-token headers directed at endpoints that do not implement AWS APIs
Repeated SigV4-signed requests from a single process to multiple unrelated hostnames within one session

Detection Strategies

Inventory applications and services that link against libcurl and identify those using CURLOPT_AWS_SIGV4
Inspect proxy and egress logs for AWS SigV4 headers destined for hosts outside AWS service domains
Perform static analysis for code patterns that set CURLOPT_AWS_SIGV4 and later assign NULL on a reused handle

Monitoring Recommendations

Enable TLS-terminating proxy inspection to capture outbound Authorization headers for policy evaluation
Alert on any process that issues SigV4-signed requests to hostnames not on an approved AWS endpoint allowlist
Correlate HTTP egress telemetry with endpoint process execution data to attribute leaking headers to specific binaries

How to Mitigate CVE-2026-86409

Immediate Actions Required

Upgrade libcurl to the fixed version listed in the cURL CVE-2026-86409 Documentation
Audit application code for any use of CURLOPT_AWS_SIGV4 and verify handle lifecycle management
Rotate any AWS credentials that may have been included in SigV4-signed requests sent to unintended destinations

Patch Information

The cURL project maintains advisory details and patched release information in the cURL CVE-2026-86409 Documentation. Consult that advisory and the cURL CVE-2026-86409 JSON Details for the specific commit and version metadata associated with the fix.

Workarounds

Use a fresh easy handle with curl_easy_init() for transfers that must not carry SigV4 authentication, rather than clearing the option on a reused handle
Call curl_easy_reset() on the handle between transfers to force a known default state before issuing non-SigV4 requests
Explicitly remove the Authorization header via CURLOPT_HTTPHEADER for transfers to non-AWS endpoints as a defense-in-depth measure

bash

# Configuration example
# Prefer a new handle instead of relying on CURLOPT_AWS_SIGV4 = NULL
# Pseudocode for safe handle hygiene between transfers
curl_easy_cleanup(handle);
handle = curl_easy_init();
# or, when reuse is required:
curl_easy_reset(handle);