Vulnerability · Published Jul 3, 2026 · Assigned by curl
CVE-2026-8926password leak with netrc and user in URL
Critical 9.1
In plain English
A critical-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | curl | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:10 | libcurl | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:10 | libcurl-devel | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:10 | libcurl-minimal | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| Alpine:v3.23 | curl | 8.22.0-r0 | ALPINE-CVE-2026-8926 |
| Alpine:v3.24 | curl | 8.21.0-r0 | ALPINE-CVE-2026-8926 |
| Debian:13 | curl | no fix listed | DEBIAN-CVE-2026-8926 |
| Debian:14 | curl | 8.21.0~rc2-1 | DEBIAN-CVE-2026-8926 |
| Rocky Linux:10 | curl | 0:8.12.1-4.el10_2.6 | RLSA-2026:69125 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.4 | UBUNTU-CVE-2026-8926 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.2 | UBUNTU-CVE-2026-8926 |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N