CVE-2026-8926: Haxx Curl Information Disclosure Bug

CVE-2026-8926 Overview

CVE-2026-8926 is a credential handling flaw in curl that causes the tool to send the wrong user's password when authenticating against a remote host. When a caller instructs curl to consult a .netrc file for credentials and simultaneously supplies a URL containing a username without a password, such as https://user@example.com/, curl may retrieve and transmit the password belonging to a different user listed in .netrc for the same host. The bug affects the credential lookup logic used across HTTP, FTP, and other protocols that consume .netrc entries. It is tracked under CWE-522: Insufficiently Protected Credentials.

Critical Impact
curl can transmit a stored .netrc password to a remote host under the wrong username, exposing credentials to unintended recipients and enabling account impersonation.

Affected Products

Haxx curl (command-line tool)
libcurl (client library consuming .netrc)
Applications and scripts that invoke curl with --netrc or --netrc-file

Discovery Timeline

2026-07-03 - CVE-2026-8926 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-8926

Vulnerability Analysis

The vulnerability lives in curl's credential resolution path. curl accepts a username inside the URL and, when --netrc is active, consults .netrc to fill in a matching password. The lookup should require both host and username to match a .netrc entry before returning that entry's password.

Instead, when no .netrc record matches the specified user for the target host, curl falls back to returning the password of an unrelated user recorded for the same host. curl then sends that mismatched credential pair over the wire during authentication. The receiving server sees a valid username paired with another account's secret.

The flaw is categorized as insufficiently protected credentials [CWE-522]. Because the attack vector is network-based and exploitation requires no user interaction, an attacker who controls or observes the destination server can capture stored .netrc passwords intended for other identities.

Root Cause

The root cause is a logic error in the .netrc lookup routine. The function does not enforce a strict username match before yielding a password. When the requested username is absent from .netrc, the code returns the first available password for the host instead of returning no credential.

Attack Vector

Exploitation requires that a victim invokes curl (or an application linked against libcurl) with .netrc credential resolution enabled and provides a URL containing a username without a password. If the attacker controls the target host or can intercept the authentication exchange, they receive a password bound to a different .netrc entry. Automated pipelines, CI/CD runners, and backup scripts that rely on .netrc are the most exposed callers.

No verified public exploit code exists at the time of publication. Refer to the cURL CVE-2026-8926 Advisory for authoritative technical detail.

Detection Methods for CVE-2026-8926

Indicators of Compromise

Authentication failures on servers referenced by .netrc, immediately followed by successful logins using a different account.
Outbound curl or libcurl requests where the URL supplies a username but no password and --netrc or CURLOPT_NETRC is enabled.
Unexpected access events on accounts whose credentials are stored in operator or service .netrc files.

Detection Strategies

Inventory scripts and services that call curl with --netrc, --netrc-file, or set CURLOPT_NETRC and audit the URLs they construct.
Compare curl and libcurl versions across hosts against the fixed release listed in the vendor advisory.
Correlate authentication logs on shared hosts to detect a single client offering credentials tied to multiple accounts.

Monitoring Recommendations

Alert on server-side authentication events where the same source uses several usernames against one host in quick succession.
Track process command lines invoking curl with .netrc options to identify vulnerable callers.
Monitor changes to .netrc files on shared build agents and jump hosts to reduce blast radius.

How to Mitigate CVE-2026-8926

Immediate Actions Required

Upgrade curl and libcurl to the fixed version identified in the cURL advisory.
Rotate any passwords stored in shared .netrc files that were used with URLs containing an explicit username.
Audit automation that supplies URLs of the form https://user@host/ while .netrc is active.

Patch Information

Haxx published the fix alongside the advisory at curl.se/docs/CVE-2026-8926.html and machine-readable metadata at curl.se/docs/CVE-2026-8926.json. Additional context is available in HackerOne Report #3735184. Apply the vendor-supplied package update through the platform package manager or rebuild from the patched source release.

Workarounds

Disable .netrc consumption by removing --netrc and --netrc-file flags and unsetting CURLOPT_NETRC in application code.
Supply credentials explicitly on the command line or through CURLOPT_USERPWD instead of relying on .netrc matching.
Restrict .netrc files to a single username per host to remove the ambiguous fallback condition.
Store secrets in a dedicated secret manager and inject them at runtime rather than persisting them in .netrc.

bash

# Configuration example: remove .netrc reliance and pass credentials explicitly
curl --user "user:$USER_PASSWORD" https://example.com/

# Or constrain .netrc to a single machine/login pair
# ~/.netrc
machine example.com
  login user
  password $USER_PASSWORD