CVE-2026-86410None▾ SunlitA flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0curl >= 8.10.1 <= 8.10.1curl >= 8.10.0 <= 8.10.0curl >= 8.9.1 <= 8.9.1curl >= 8.9.0 <= 8.9.0curl >= 8.8.0 <= 8.8.0curl >= 8.7.1 <= 8.7.1curl >= 8.7.0 <= 8.7.0curl >= 8.6.0 <= 8.6.0curl >= 8.5.0 <= 8.5.0curl >= 8.4.0 <= 8.4.0curl >= 8.3.0 <= 8.3.0curl >= 8.2.1 <= 8.2.1curl >= 8.2.0 <= 8.2.0curl >= 8.1.2 <= 8.1.2curl >= 8.1.1 <= 8.1.1curl >= 8.1.0 <= 8.1.0curl >= 8.0.1 <= 8.0.1curl >= 8.0.0 <= 8.0.0curl >= 7.88.1 <= 7.88.1curl >= 7.88.0 <= 7.88.0curl >= 7.87.0 <= 7.87.0curl >= 7.86.0 <= 7.86.0curl >= 7.85.0 <= 7.85.0curl >= 7.84.0 <= 7.84.0curl >= 7.83.1 <= 7.83.1curl >= 7.83.0 <= 7.83.0curl >= 7.82.0 <= 7.82.0curl >= 7.81.0 <= 7.81.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-2466Medium· 6.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS
CVE-2025-15079Medium· 5.3When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *glob…
CVE-2026-9547High· 7.4When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server
CVE-2026-12064High· 7.5When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl
CVE-2026-87861Nonecross-origin reuse of a Negotiate connection
CVE-2026-86415Noneauto client cert connection reuse mixup