{"id":"CVE-2026-9547","title":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server","summary":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\nty…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-297","CWE-347"],"vendor":"haxx","product":"curl","affected":["curl >= 7.69.0, < 8.21.0"],"patched":["curl 8.21.0"],"published":"2026-07-03","updated":"2026-09-15","sourceUpdated":"2026-09-15T07:16:35.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","references":[{"url":"https://curl.se/docs/CVE-2026-9547.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2026-9547.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3751712","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3751712","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9547.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547"},{"url":"https://access.redhat.com/errata/RHSA-2026:60440"},{"url":"https://access.redhat.com/errata/RHSA-2026:55450"},{"url":"https://access.redhat.com/errata/RHSA-2026:55439"},{"url":"https://access.redhat.com/errata/RHSA-2026:63140"},{"url":"https://access.redhat.com/errata/RHSA-2026:63135"},{"url":"https://access.redhat.com/errata/RHSA-2026:63138"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783"},{"url":"https://access.redhat.com/errata/RHSA-2026:29017"},{"url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"url":"https://access.redhat.com/errata/RHSA-2026:56869"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981"},{"url":"https://access.redhat.com/errata/RHSA-2026:66018"},{"url":"https://access.redhat.com/errata/RHSA-2026:66357"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-07-06T16:47:32.456534Z"},"epss":0.00325,"epssPercentile":0.2577,"ingestedAt":"2026-07-04T06:55:48.808Z","slug":"CVE-2026-9547","body":"## Overview\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.\n\n## Affected\n\n- `curl >= 7.69.0, < 8.21.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.21.0`\n\n## Vendor advisories\n\n- **RHSA-2026:60440** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60440)\n- **RHSA-2026:55450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55450)\n- **RHSA-2026:55439** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55439)\n- **RHSA-2026:63140** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63140)\n- **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135)\n- **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)\n- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)\n- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)\n- **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260)\n- **RHSA-2026:66357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66357)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":203516,"id":"CVE-2026-9547","ts":1789457645894,"field":"exploit_available","old":"false","new":"true"},{"seq":202638,"id":"CVE-2026-9547","ts":1789400101117,"field":"cvss","old":null,"new":"7.4"},{"seq":202637,"id":"CVE-2026-9547","ts":1789400101117,"field":"severity","old":"none","new":"high"},{"seq":201365,"id":"CVE-2026-9547","ts":1789397621532,"field":"cvss","old":"7.4","new":null},{"seq":201364,"id":"CVE-2026-9547","ts":1789397621532,"field":"severity","old":"high","new":"none"},{"seq":200058,"id":"CVE-2026-9547","ts":1789395587871,"field":"cvss","old":null,"new":"7.4"},{"seq":200057,"id":"CVE-2026-9547","ts":1789395587871,"field":"severity","old":"none","new":"high"},{"seq":199295,"id":"CVE-2026-9547","ts":1789392261569,"field":"cvss","old":"7.4","new":null},{"seq":199294,"id":"CVE-2026-9547","ts":1789392261569,"field":"severity","old":"high","new":"none"},{"seq":197628,"id":"CVE-2026-9547","ts":1789384304481,"field":"cvss","old":null,"new":"7.4"},{"seq":197627,"id":"CVE-2026-9547","ts":1789384304481,"field":"severity","old":"none","new":"high"},{"seq":196902,"id":"CVE-2026-9547","ts":1789383784430,"field":"cvss","old":"7.4","new":null},{"seq":196901,"id":"CVE-2026-9547","ts":1789383784430,"field":"severity","old":"high","new":"none"},{"seq":195806,"id":"CVE-2026-9547","ts":1789380595282,"field":"cvss","old":null,"new":"7.4"},{"seq":195805,"id":"CVE-2026-9547","ts":1789380595282,"field":"severity","old":"none","new":"high"},{"seq":194757,"id":"CVE-2026-9547","ts":1789378790692,"field":"cvss","old":"7.4","new":null},{"seq":194756,"id":"CVE-2026-9547","ts":1789378790692,"field":"severity","old":"high","new":"none"},{"seq":193544,"id":"CVE-2026-9547","ts":1789376549374,"field":"cvss","old":null,"new":"7.4"},{"seq":193543,"id":"CVE-2026-9547","ts":1789376549374,"field":"severity","old":"none","new":"high"},{"seq":192331,"id":"CVE-2026-9547","ts":1789373640529,"field":"cvss","old":"7.4","new":null},{"seq":192330,"id":"CVE-2026-9547","ts":1789373640529,"field":"severity","old":"high","new":"none"},{"seq":191116,"id":"CVE-2026-9547","ts":1789369511798,"field":"cvss","old":null,"new":"7.4"},{"seq":191115,"id":"CVE-2026-9547","ts":1789369511798,"field":"severity","old":"none","new":"high"},{"seq":189903,"id":"CVE-2026-9547","ts":1789368462079,"field":"cvss","old":"7.4","new":null},{"seq":189902,"id":"CVE-2026-9547","ts":1789368462079,"field":"severity","old":"high","new":"none"},{"seq":188686,"id":"CVE-2026-9547","ts":1789365245547,"field":"cvss","old":null,"new":"7.4"},{"seq":188685,"id":"CVE-2026-9547","ts":1789365245547,"field":"severity","old":"none","new":"high"},{"seq":187473,"id":"CVE-2026-9547","ts":1789363481390,"field":"cvss","old":"7.4","new":null},{"seq":187472,"id":"CVE-2026-9547","ts":1789363481390,"field":"severity","old":"high","new":"none"},{"seq":186259,"id":"CVE-2026-9547","ts":1789361249442,"field":"cvss","old":null,"new":"7.4"},{"seq":186258,"id":"CVE-2026-9547","ts":1789361249442,"field":"severity","old":"none","new":"high"},{"seq":185046,"id":"CVE-2026-9547","ts":1789358399066,"field":"cvss","old":"7.4","new":null},{"seq":185045,"id":"CVE-2026-9547","ts":1789358399066,"field":"severity","old":"high","new":"none"},{"seq":183295,"id":"CVE-2026-9547","ts":1789354333774,"field":"cvss","old":null,"new":"7.4"},{"seq":183294,"id":"CVE-2026-9547","ts":1789354333774,"field":"severity","old":"none","new":"high"},{"seq":182088,"id":"CVE-2026-9547","ts":1789353336378,"field":"cvss","old":"7.4","new":null},{"seq":182087,"id":"CVE-2026-9547","ts":1789353336378,"field":"severity","old":"high","new":"none"},{"seq":180881,"id":"CVE-2026-9547","ts":1789350307081,"field":"cvss","old":null,"new":"7.4"},{"seq":180880,"id":"CVE-2026-9547","ts":1789350307081,"field":"severity","old":"none","new":"high"},{"seq":179674,"id":"CVE-2026-9547","ts":1789348309739,"field":"cvss","old":"7.4","new":null},{"seq":179673,"id":"CVE-2026-9547","ts":1789348309739,"field":"severity","old":"high","new":"none"},{"seq":178467,"id":"CVE-2026-9547","ts":1789346386726,"field":"cvss","old":null,"new":"7.4"},{"seq":178466,"id":"CVE-2026-9547","ts":1789346386726,"field":"severity","old":"none","new":"high"},{"seq":177260,"id":"CVE-2026-9547","ts":1789343189700,"field":"cvss","old":"7.4","new":null},{"seq":177259,"id":"CVE-2026-9547","ts":1789343189700,"field":"severity","old":"high","new":"none"},{"seq":175377,"id":"CVE-2026-9547","ts":1789334899245,"field":"cvss","old":null,"new":"7.4"},{"seq":175376,"id":"CVE-2026-9547","ts":1789334899245,"field":"severity","old":"none","new":"high"},{"seq":174172,"id":"CVE-2026-9547","ts":1789333718055,"field":"cvss","old":"7.4","new":null},{"seq":174171,"id":"CVE-2026-9547","ts":1789333718055,"field":"severity","old":"high","new":"none"},{"seq":172986,"id":"CVE-2026-9547","ts":1789331108667,"field":"cvss","old":null,"new":"7.4"}]}