CVE-2026-87861

A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests intended for one server to be transmitted over an established connection to another, potentially resulting in information disclosure.

Red Hat Product Security rates this vulnerability as Low impact because exploitation requires specific preconditions involving Negotiate authentication with ambient credentials, and successful exploitation only results in limited information exposure without compromising system integrity or availability. In typical Red Hat environments, applications rarely multiplex requests across different origins while relying on blank user identities for Kerberos or SPNEGO authentication. As a result, standard enterprise deployments face minimal exposure unless custom software explicitly employs this credential handling pattern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.