Vulnerability · Published Mar 11, 2026 · Assigned by curl
CVE-2026-3783token leak with redirect and netrc
Medium 5.3
In plain English
A medium-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | curl | 7.76.1-40.el9_8.5 | ALSA-2026:55439 |
| AlmaLinux:9 | curl-minimal | 7.76.1-40.el9_8.5 | ALSA-2026:55439 |
| AlmaLinux:9 | libcurl | 7.76.1-40.el9_8.5 | ALSA-2026:55439 |
| AlmaLinux:9 | libcurl-devel | 7.76.1-40.el9_8.5 | ALSA-2026:55439 |
| AlmaLinux:9 | libcurl-minimal | 7.76.1-40.el9_8.5 | ALSA-2026:55439 |
| Alpine:v3.21 | curl | 8.14.1-r3 | ALPINE-CVE-2026-3783 |
| Alpine:v3.22 | curl | 8.14.1-r4 | ALPINE-CVE-2026-3783 |
| Alpine:v3.23 | curl | 8.19.0-r0 | ALPINE-CVE-2026-3783 |
| Alpine:v3.24 | curl | 8.19.0-r0 | ALPINE-CVE-2026-3783 |
| Debian:12 | curl | 7.88.1-10+deb12u15 | DEBIAN-CVE-2026-3783 |
| Debian:13 | curl | 8.14.1-2+deb13u4 | DEBIAN-CVE-2026-3783 |
| Debian:14 | curl | 8.19.0-1 | DEBIAN-CVE-2026-3783 |
| Rocky Linux:9 | curl | 0:7.76.1-40.el9_8.5 | RLSA-2026:55439 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.23 | USN-8084-1 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.23 | UBUNTU-CVE-2026-3783 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.8 | USN-8084-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.8 | UBUNTU-CVE-2026-3783 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.2 | UBUNTU-CVE-2026-3783 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.2 | USN-8084-1 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2 | UBUNTU-CVE-2026-3783 |
| Ubuntu:26.10 | curl | 8.18.0-1ubuntu2 | UBUNTU-CVE-2026-3783 |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N