CVE-2026-6429 netrc credential leak with reused proxy connection
An attacker can steal netrc credentials from the first host when libcurl follows HTTP redirects to a different host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6429?
CVE-2026-6429 is a medium-severity vulnerability in Haxx Curl, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
Weakness: CWE-200
Which versions are affected by CVE-2026-6429?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-6429?
Upgrade to a fixed version.
Is CVE-2026-6429 being exploited?
There is no known exploitation of CVE-2026-6429 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-6429, AZL-86661, AZL-86688, BELL-CVE-2026-6429, CURL-CVE-2026-6429, DEBIAN-CVE-2026-6429 and 8 more.