CVE-2026-8926Haxx Curl Insufficiently Protected Credentials
NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vulnerability Summary
When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://user@example.com/`, curl could wrongly get and use the password for
*another* user set in the `.netrc` file for that host if such a one exists and
there is no match for the specified user.
time specifying a URL with a username(without a password), like
`https://user@example.com/`, curl could wrongly get and use the password for
*another* user set in the `.netrc` file for that host if such a one exists and
there is no match for the specified user.
CVSS v3.1 Base Metrics — Score 9.1 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
Affected & Patched Versions
- Haxx Curl >= 8.11.1 and < 8.21.0
- Haxx Curl 8.21.0
What to do
Prioritize this fix. Exploit code is public, so attacks can follow quickly.
- Check whether you run Haxx Curl and which version.
- Update to a patched version listed above, then confirm the new version.
- Review logs and exposed services for signs of earlier compromise.
Timeline
- Jul 3, 2026Published
- Jul 7, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Haxx Curl CVEsYou are reading CVE-2026-8926. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 03:31 UTC