--- id: CVE-2026-9547 title: |- When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server summary: |- When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key ty… severity: high cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-297 - CWE-347 vendor: haxx product: curl affected: - 'curl >= 7.69.0, < 8.21.0' patched: - curl 8.21.0 published: '2026-07-03' updated: '2026-09-15' sourceUpdated: '2026-09-15T07:16:35.310' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9547' references: - url: 'https://curl.se/docs/CVE-2026-9547.html' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://curl.se/docs/CVE-2026-9547.json' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://hackerone.com/reports/3751712' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://hackerone.com/reports/3751712' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9547.json - url: 'https://access.redhat.com/security/cve/CVE-2026-9547' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496758' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-9547' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9547' - url: 'https://access.redhat.com/errata/RHSA-2026:60440' - url: 'https://access.redhat.com/errata/RHSA-2026:55450' - url: 'https://access.redhat.com/errata/RHSA-2026:55439' - url: 'https://access.redhat.com/errata/RHSA-2026:63140' - url: 'https://access.redhat.com/errata/RHSA-2026:63135' - url: 'https://access.redhat.com/errata/RHSA-2026:63138' - url: 'https://access.redhat.com/errata/RHSA-2026:61783' - url: 'https://access.redhat.com/errata/RHSA-2026:29017' - url: 'https://access.redhat.com/errata/RHSA-2026:34975' - url: 'https://access.redhat.com/errata/RHSA-2026:56869' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:58981' - url: 'https://access.redhat.com/errata/RHSA-2026:66018' - url: 'https://access.redhat.com/errata/RHSA-2026:66357' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-07-06T16:47:32.456534Z' epss: 0.00508 epssPercentile: 0.40696 ingestedAt: '2026-07-04T06:55:48.808Z' --- ## Overview When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. ## Affected - `curl >= 7.69.0, < 8.21.0` ## Remediation Upgrade past the affected range: - `curl 8.21.0` ## Vendor advisories - **RHSA-2026:60440** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60440) - **RHSA-2026:55450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55450) - **RHSA-2026:55439** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55439) - **RHSA-2026:63140** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63140) - **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135) - **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017) - **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975) - **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869) - **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260) - **RHSA-2026:66357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66357)