CVE-2026-87861
Description
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests intended for one server to be transmitted over an established connection to another, potentially resulting in information disclosure.
Statement
Red Hat Product Security rates this vulnerability as Low impact because exploitation requires specific preconditions involving Negotiate authentication with ambient credentials, and successful exploitation only results in limited information exposure without compromising system integrity or availability. In typical Red Hat environments, applications rarely multiplex requests across different origins while relying on blank user identities for Kerberos or SPNEGO authentication. As a result, standard enterprise deployments face minimal exposure unless custom software explicitly employs this credential handling pattern.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Acknowledgements
Red Hat would like to thank Axel Mierczuk for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
