CVE-2026-8927 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-8927 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-8927 is a proxy authentication state persistence vulnerability in Haxx libcurl, where reused transfer handles fail to clear authentication credentials between sequential HTTP requests when proxy configuration is sourced from environment variables.

Technical Detail

The flaw occurs when an application reuses a libcurl handle across multiple transfers and proxy settings are supplied via environment variables such as HTTP_PROXY or HTTPS_PROXY. libcurl fails to reset the proxy authentication state between requests, meaning credentials or authentication context established during a prior transfer persist into subsequent ones. The practical impact is unauthorized credential reuse or authentication bypass at the proxy layer, which could allow requests to be forwarded through an authenticated proxy without the caller supplying valid credentials, or could cause one session's authentication material to leak into an unrelated transfer context.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently undemonstrated, and CVE-2026-8927 has not been added to the CISA Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code confirmed as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Organizations using libcurl in applications that reuse handles across sequential transfers with environment-variable-driven proxy configuration should prioritize patching to the latest available version of libcurl that addresses this flaw. As an interim workaround, developers can mitigate exposure by explicitly calling curl_easy_reset() on handles between transfers, which forces a full state reset including authentication context. Applications that do not reuse libcurl handles or do not rely on environment-variable proxy configuration are not affected by this specific code path. Given the CVSS score of 9.1, patch deployment should be treated as high priority even in the absence of active exploitation. Monitor proxy authentication logs for anomalous credential reuse patterns as a detection signal.