CVE-2026-86410

Awaiting Analysis Awaiting Analysis - Queue

SSH Host Key Verification Bypass in curl

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: curl

Description

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-86410

EUVD

EUVD-2026-105275

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0
curl	curl	7.85.0
curl	curl	7.84.0
curl	curl	7.83.1
curl	curl	7.83.0
curl	curl	7.82.0
curl	curl	7.81.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

This vulnerability is in the curl command line tool where SSH host verification options are only applied when directly using SFTP or SCP. If an HTTPS URL redirects to an SFTP or SCP URL, the connection proceeds without host verification methods like --knownhosts, even if specified by the user.

Detection Guidance

Check curl version with 'curl --version' to see if it falls within vulnerable range 7.81.0 to 8.22.0. Monitor network traffic for redirects from HTTPS to SFTP/SCP protocols using packet capture tools like tcpdump or Wireshark.

Impact Analysis

This flaw could allow an attacker to bypass host verification by redirecting a connection to an untrusted SFTP or SCP server. This means sensitive data transferred over these protocols might be exposed to unauthorized parties.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it relates to SSH host verification bypass during redirects in curl. However, if an organization relies on SSH host verification for secure data transfers (e.g., file transfers containing personal or health data), this flaw could undermine secure communication channels, potentially violating data protection requirements that mandate secure transmission of sensitive information.

Mitigation Strategies

Upgrade curl to version 8.23.0 or later. If upgrading isn't possible, avoid using redirects to SFTP/SCP protocols. Review and update host verification configurations to ensure they apply even with redirects.

Hi! I’m here to help you understand CVE-2026-86410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...