Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-03T06:15:45 curl: curl: Information disclosure via incorrect .netrc password lookup 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N CWE-289

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

A flaw was found in curl. When curl is configured to use a .netrc file for credentials and a URL is provided with a username but no password, curl may incorrectly retrieve and use the password for a different user from the .netrc file for the same host. This could lead to unauthorized information disclosure, as curl might connect using unintended credentials.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 10 Fix deferred curl Red Hat Enterprise Linux 6 Fix deferred curl Red Hat Enterprise Linux 7 Fix deferred curl Red Hat Enterprise Linux 8 Fix deferred curl Red Hat Enterprise Linux 9 Fix deferred curl Red Hat OpenShift Container Platform 4 Fix deferred rhcos Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat Trusted Profile Analyzer Fix deferred rhtpa/rhtpa-trustification-service-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-8926 https://nvd.nist.gov/vuln/detail/CVE-2026-8926 https://curl.se/docs/CVE-2026-8926.html https://curl.se/docs/CVE-2026-8926.json https://hackerone.com/reports/3735184