{"id":"CVE-2026-94265","aliases":[],"cve":{"records":[{"id":"CVE-2026-94265","source":"curl","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-21T09:07:44.636Z","published":"2026-10-20T20:26:18.061Z","modified":"2026-10-30T16:19:18.095Z"}],"publishers":[{"name":"curl","role":"CNA","organizationId":"2499f714-1537-4658-8207-48ae4bb9eae9","modified":"2026-10-20T20:26:18.061Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:19:18.095Z"}],"references":[{"url":"https://curl.se/docs/CVE-2026-94265.json","tags":[],"source":"curl"},{"url":"https://curl.se/docs/CVE-2026-94265.html","tags":[],"source":"curl"},{"url":"https://hackerone.com/reports/4040551","tags":[],"source":"curl"},{"url":"https://hackerone.com/reports/4040551","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:18:54.642885Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authorization: Negotiate sent to foreign origin","titleSource":"curl","descriptionSource":"curl","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`.","score":9.1,"severity":"critical","published":"2026-10-20T20:26:18.061Z","modified":"2026-10-30T16:19:18.095Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"curl","name":"curl","platforms":[],"versions":[{"version":"8.22.0","status":"affected","lessThanOrEqual":"8.22.0","versionType":"semver"},{"version":"8.21.0","status":"affected","lessThanOrEqual":"8.21.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"curl","url":"https://www.cve.org/CVERecord?id=CVE-2026-94265"}],"remediation":[],"references":["https://curl.se/docs/CVE-2026-94265.json","https://curl.se/docs/CVE-2026-94265.html","https://hackerone.com/reports/4040551"],"sources":[{"name":"CVE","id":"CVE-2026-94265","modified":"2026-10-30T16:19:18.095Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94265"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-30T17:29:04.776Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:15:34.698Z","attemptedAt":"2026-10-30T18:15:34.698Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T18:15:34.696Z","attemptedAt":"2026-10-30T18:15:34.696Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T18:15:35.626Z","attemptedAt":"2026-10-30T18:15:35.626Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T18:15:32.258Z","attemptedAt":"2026-10-30T18:15:32.258Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-94265","url":"https://www.first.org/epss/","probability":0.00338,"percentile":0.27292,"date":"2026-10-30","checkedAt":"2026-10-30T18:15:32.258Z"},{"source":"GitHub Advisory Database","id":"GHSA-qqmr-6r9w-pmx5","url":"https://github.com/advisories/GHSA-qqmr-6r9w-pmx5","modified":"2026-10-20T21:31:09Z","checkedAt":"2026-10-30T18:15:34.696Z"},{"source":"NVD","id":"CVE-2026-94265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","modified":"2026-10-30T17:17:31.783","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-10-30T18:15:34.698Z"},{"source":"ENISA EUVD","id":"EUVD-2026-105353","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105353","modified":"Oct 30, 2026, 4:19:18 PM","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-10-30T18:15:35.626Z"}],"aiSummary":null}