CVE-2026-86410: redirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
Other sources
redirect to SFTP or SCP bypasses host verification
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1
Event History
Frequently Asked Questions
When can SSH host verification be bypassed?
The bypass occurs when the curl command-line tool follows a redirect to an SFTP or SCP destination. Direct SFTP or SCP transfers set the SSH host-verification options, but redirected transfers do not.
What attacker capability is needed to exploit this?
An attacker would need to cause curl to follow a redirect to an SFTP or SCP endpoint. The provided information does not specify additional prerequisites or affected command-line options.