CVE-2026-9079 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-9079 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9079 is a credential persistence flaw in Haxx libcurl, the widely used client-side URL transfer library, where proxy authentication credentials are not properly cleared when explicitly instructed to be removed.

Technical Detail

The flaw exists in libcurl's handling of proxy authentication credential lifecycle management: when an application instructs libcurl to clear proxy credentials, the library fails to execute that operation, leaving stale credentials resident in memory. Subsequent transfers initiated through the same libcurl handle or session context may then silently reuse those credentials against proxy endpoints that were never intended to receive them. The practical impact includes unauthorized credential exposure to unintended proxy infrastructure, potential authentication bypass of access controls, and inadvertent credential leakage across security boundaries in multi-tenant or multi-destination transfer scenarios.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been identified as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with CVE-2026-9079 in available intelligence sources.

What To Do

Apply the vendor-supplied patch from Haxx for the affected version of libcurl as soon as it is available, prioritizing systems where libcurl is used in environments that route transfers through multiple proxy endpoints or where proxy credentials carry elevated access. Organizations should audit applications that rely on libcurl's credential management APIs to identify any code paths that call credential-clearing functions and verify expected behavior post-patch. As an interim workaround, consider reinitializing libcurl handles entirely between transfers that require distinct proxy authentication contexts rather than relying on in-session credential clearing. Monitor proxy authentication logs for anomalous reuse of credentials across unrelated transfer sessions as a detection signal.