CVE-2026-86414

A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens.

This vulnerability is rated as having a Low security impact because exploitation relies on routing outbound traffic through an untrusted or compromised HTTP proxy server. In standard Red Hat Enterprise Linux environments, proxy infrastructure is centrally managed within trusted network boundaries, significantly minimizing the likelihood of a rogue proxy tampering with tunnel handshakes. Furthermore, target endpoint authentication credentials are only exposed if a client actively transmits authentication data over a proxied tunnel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.