CVE-2026-86413

CVE-2026-86413

published October 21, 2026

CVSS
—
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

When using an *ambient user* in a first transfer doing Negotiate

authentication and asked to follow redirects, curl could pass on its

credential details to an unrelated second origin when asked to redirect there.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Published
2026-10-21T00:17Z
References (3)
https://curl.se/docs/CVE-2026-86413.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2026-86413.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3993549 · 2499f714-1537-4658-8207-48ae4bb9eae9
EPSS history
Timeline
  • 22 OCT 03:35Z
    EPSS moved — → 0%
    epss
  • 20 OCT 20:06Z
    Negotiate credentials sent to redirected origin
    cvelistv5
  • 20 OCT 20:06Z
    Negotiate credentials sent to redirected origin
    cvelistv5