CVE-2026-86410

A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure.

Red Hat has evaluated this vulnerability as having a Low severity impact because exploitation requires an uncommon combination of non-default command-line flags and does not affect applications utilizing libcurl. Under standard configurations, curl restricts redirect targets and prevents following redirects to SSH protocols by default. A risk of omitted SSH host verification only arises when a user explicitly directs the standalone curl command-line binary to follow redirects and overrides protocol restrictions to allow SFTP or SCP.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.