CVE-2026-8926 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-8926 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-8926 is a credential disclosure vulnerability in Haxx curl, affecting the logic that resolves credentials from a .netrc file when a URL is supplied with a username but no password.

Technical Detail

The flaw occurs when curl is invoked with both the --netrc or --netrc-file option and a URL that includes a username component but omits a password, such as https://[email protected]/. Under this condition, curl incorrectly retrieves and applies credentials from the .netrc file in a manner that may result in the wrong credentials being used or unintended credentials being transmitted to a remote host. The practical impact is unauthorized credential exposure, where credentials belonging to a different account or host entry within the .netrc file may be sent to an attacker-controlled or unintended server, constituting an authentication material leak.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code confirmed as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Organizations and individuals using curl with .netrc credential files should update to the patched version of curl as soon as it becomes available from Haxx or the relevant distribution maintainer. As an immediate workaround, avoid combining .netrc file usage with URLs that specify a username without a password; instead, supply full credentials explicitly via the URL or through a dedicated credential manager. Audit any automated scripts or CI/CD pipelines that invoke curl with --netrc flags alongside user-prefixed URLs, and review .netrc file contents to assess the sensitivity of stored credentials. Given the CVSS score of 9.1, treat this as a high-priority patch even in the absence of confirmed active exploitation.