CVE-2026-11856 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-11856 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-11856 is a credential leakage vulnerability in Haxx libcurl, the widely used client-side URL transfer library, where Digest authentication credentials are incorrectly reused across distinct HTTP origins during connection reuse.

Technical Detail

The flaw occurs when an application uses libcurl to perform an authenticated transfer to a first HTTP host using Digest authentication, then reuses the same connection or session handle to transfer to a different host without properly clearing the stored authentication context. This allows the Digest credentials intended for the first origin to be sent to the second, unintended host, resulting in unauthorized credential disclosure to a third-party server. The practical impact is credential exposure and potential unauthorized access, particularly in multi-tenant or proxy-chained environments where origin switching is common programmatic behavior.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as zero, meaning no public proof-of-concept code or observed exploitation has been recorded. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Organizations using libcurl in applications that perform multi-origin HTTP transfers with Digest authentication should prioritize patching to the fixed version of libcurl once released by Haxx. As an interim workaround, developers should explicitly reset or reinitialize the curl handle, including clearing authentication credentials via CURLOPT_USERPWD and related options, before switching to a different target origin within the same session. Applications that do not use Digest authentication or do not switch origins mid-session are not affected by this specific code path. Monitor the official Haxx security advisory page and the curl project release notes for patch availability and version guidance. Given the CVSS score of 9.8, treat this as a high-priority patch item in any environment where libcurl handles sensitive authentication workflows.