CVE-2026-8926

CRITICAL 9.1

password leak with netrc and user in URL

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://[email protected]/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

CWE	CWE-522
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new critical vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.11.1 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1

curl / curl

e9b9bbac22c26cf67316fa8e6c6b9e831af31949 < 4ae1d7cc2643e4773a136395f12bc02fc6867854

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0 8.12.1 8.12.0 8.11.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-8926.json curl.se: https://curl.se/docs/CVE-2026-8926.html hackerone.com: https://hackerone.com/reports/3735184

Credits

Joshua Rogers (Aisle Research) Stefan Eissing