CVE-2026-87861: cross-origin reuse of a Negotiate connection
cross-origin reuse of a Negotiate connection
Other sources
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.23.0-1 - Upgrade
Upgrade
curlto a version that resolves this vulnerability.Fixed in 8.23.0 - Compensating control
Avoid using ambient users for authentication
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when HTTP requests use ambient user credentials and Negotiate authentication, and a request for one origin can be dispatched on a connection previously authenticated for another origin.
What credential context is used for an affected request?
The request may be sent over the previously Negotiate-authenticated connection for the other origin. Its intended credentials are left unused.