CVE-2026-6429

A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.

Moderate: A flaw in libcurl could lead to credential leakage. This issue occurs when libcurl is configured to use a .netrc file for credentials and follows HTTP redirects, potentially exposing passwords to the redirected host. Exploitation requires both the original and redirect URLs to be clear text HTTP, performed over the same HTTP proxy, and with connection reuse. The curl command-line tool is not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent the credential leak, avoid using the combination of .netrc for credentials, clear text HTTP URLs, and an HTTP proxy when making requests with libcurl. This operational control prevents the specific conditions that enable the vulnerability.