CVE-2026-86410

Received Received - Intake

SSH Host Key Verification Bypass in curl

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: curl

Description

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-86410

EUVD

EUVD-2026-105275

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0
curl	curl	7.85.0
curl	curl	7.84.0
curl	curl	7.83.1
curl	curl	7.83.0
curl	curl	7.82.0
curl	curl	7.81.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the curl command line tool where SSH host verification options are only applied when directly using SFTP or SCP. If an HTTPS URL redirects to an SFTP or SCP URL, the connection proceeds without host verification methods like --knownhosts, even if specified by the user.

Detection Guidance

Check curl version with 'curl --version' to see if it falls within vulnerable range 7.81.0 to 8.22.0. Monitor network traffic for redirects from HTTPS to SFTP/SCP protocols using packet capture tools like tcpdump or Wireshark.

Impact Analysis

This flaw could allow an attacker to bypass host verification by redirecting a connection to an untrusted SFTP or SCP server. This means sensitive data transferred over these protocols might be exposed to unauthorized parties.

Mitigation Strategies

Upgrade curl to version 8.23.0 or later. If upgrading isn't possible, avoid using redirects to SFTP/SCP protocols. Review and update host verification configurations to ensure they apply even with redirects.

Hi! I’m here to help you understand CVE-2026-86410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70