CVE-2026-94265

A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries.

This vulnerability is rated as Low severity because exploitation requires a specific, non-default combination of features, including Kerberos-based authentication and automatic redirection handling. In typical Red Hat deployments, clients only face exposure if an application or script connects to a malicious server that redirects requests to an untrusted third party using credentials embedded in the destination URL. Because curl does not follow HTTP redirects by default and Negotiate authentication is restricted to targeted enterprise workflows, the potential blast radius is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.