CVE-2026-3783 token leak with redirect and netrc
An attacker can steal OAuth2 bearer tokens if curl redirects to a host with netrc entries, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3783?
CVE-2026-3783 is a medium-severity vulnerability in Haxx Curl, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.
If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.
Weakness: CWE-522
Which versions are affected by CVE-2026-3783?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-3783?
Upgrade to a fixed version.
Is CVE-2026-3783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3783 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-3783, AZL-79673, BELL-CVE-2026-3783, CLSA-2026-1773938530, CLSA-2026-1773939685, CURL-CVE-2026-3783 and 8 more.