CVE-2026-7168 cross-proxy Digest auth state leak
libcurl leaks Digest authentication credentials from one proxy to another when reusing handles, exposing sensitive proxy authentication data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7168?
CVE-2026-7168 is a medium-severity vulnerability in Haxx Curl, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
Weakness: CWE-294
Which versions are affected by CVE-2026-7168?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-7168?
Upgrade to a fixed version.
Is CVE-2026-7168 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7168 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-7168, AZL-86669, BELL-CVE-2026-7168, CLSA-2026-1779372207, CLSA-2026-1779372929, CURL-CVE-2026-7168 and 9 more.