CVE-2026-86409

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure.

This vulnerability is rated as Low impact because it does not affect the standard curl command-line utility and requires a highly specific programmatic workflow in applications using libcurl. Triggering the flaw requires an application to reuse transfer handles across differing trust boundaries, attempt to clear AWS SigV4 authentication by resetting the option to null, and direct subsequent requests to untrusted targets. Furthermore, the resulting exposure is restricted to the access key identifier and a request-bound signature, leaving the secret key uncompromised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.