CVE-2026-8926 password leak with netrc and user in URL
Attackers can leak passwords from .netrc files when curl is used with specific URL formats, exposing credentials for other users on the same host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8926?
CVE-2026-8926 is a critical vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://[email protected]/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Weakness: CWE-522
Which versions are affected by CVE-2026-8926?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-8926?
Upgrade to a fixed version.
Is CVE-2026-8926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8926 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-8926, AZL-91821, BELL-CVE-2026-8926, CURL-CVE-2026-8926, DEBIAN-CVE-2026-8926, ECHO-6702-280a-9a7b and 12 more.