CVE-2026-94265 Authorization: Negotiate sent to foreign origin

Not scored Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-94265?

CVE-2026-94265 is a vulnerability in curl, published on 20 Oct 2026.

Official description

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.

Which versions are affected by CVE-2026-94265?

How do I fix CVE-2026-94265?

Upgrade to a fixed version.

Is CVE-2026-94265 being exploited?

There is no known exploitation of CVE-2026-94265 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-94265, BELL-CVE-2026-94265, CURL-CVE-2026-94265, DEBIAN-CVE-2026-94265, GHSA-qqmr-6r9w-pmx5, MINI-cvjf-rq6f-r9x9.