CVE-2026-86410

None

CVSS

—

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

The record

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

Affected packages

Ecosystem	Package	Introduced	Fixed