CVE-2026-86410: redirect to SFTP or SCP bypasses host verification

Published Oct 20, 2026

Updated

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

Affected Software

1 affected component

curl curl

Event History

Oct 20, 2026

CVE Published

via MITRE·07:59 PM

Data Sourced

via MITRE·07:59 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

When can SSH host verification be bypassed?

The bypass occurs when the curl command-line tool follows a redirect to an SFTP or SCP destination. Direct SFTP or SCP transfers set the SSH host-verification options, but redirected transfers do not.

What attacker capability is needed to exploit this?

An attacker would need to cause curl to follow a redirect to an SFTP or SCP endpoint. The provided information does not specify additional prerequisites or affected command-line options.

CVE-2026-86410: redirect to SFTP or SCP bypasses host verification

Affected Software

Event History

Frequently Asked Questions

When can SSH host verification be bypassed?

What attacker capability is needed to exploit this?

Company

Resources

Contact

Frequently Asked Questions

When can SSH host verification be bypassed?

What attacker capability is needed to exploit this?