CVE-2026-86414: leaking host credentials to HTTP proxy
Published Oct 20, 2026
·Updated
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:.
Affected Software
1 affected componentFixes available
debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1
8.23.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1
Event History
Oct 14, 2026
CVE Published
via Ubuntu·09:52 PM
Data Sourced
via Ubuntu·09:52 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·09:53 PM
DescriptionAffected Software
Oct 20, 2026
CVE Published
via MITRE·08:07 PM
Data Sourced
via MITRE·08:07 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
Description