CVE-2026-6429: netrc credential leak with reused proxy connection
A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.
Other sources
netrc credential leak with reused proxy connection
— Microsoft
When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6429?
CVE-2026-6429 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-6429?
To mitigate CVE-2026-6429, avoid using .netrc files with HTTP redirects and update to a patched version of libcurl.
What causes CVE-2026-6429?
CVE-2026-6429 is caused by the improper handling of credentials when following HTTP redirects while using a .netrc file.
Which versions of libcurl are affected by CVE-2026-6429?
Versions of libcurl prior to the fix release for CVE-2026-6429 are affected.
Can CVE-2026-6429 lead to credential exposure?
Yes, CVE-2026-6429 can lead to the exposure of credentials from the .netrc file when connecting to redirected hosts.