CVE-2026-87861

Awaiting Analysis Awaiting Analysis - Queue

HTTP Request Credential Leak via Negotiate Authentication

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: curl

Description

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-87861

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves HTTP requests using ambient user credentials being sent to the wrong origin due to improper connection reuse in Negotiate authentication. A request intended for one origin may be sent over a connection already authenticated for a different origin, causing the intended credentials to be ignored.

Impact Analysis

This could lead to unauthorized access to resources or data if requests are processed with incorrect credentials. It may allow attackers to bypass authentication checks or access sensitive information intended for another origin.

Hi! I’m here to help you understand CVE-2026-87861. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...