CVE-2026-86413

None

CVSS

—

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

The record

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

Affected packages

Ecosystem	Package	Introduced	Fixed