CVE-2026-8926: password leak with netrc and user in URL

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-03 · updated 2026-09-15
Weakness: CWE-522

Description

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

Affected products

curl: from 8.11.1 before 8.21.0 — fixed in 8.21.0

How to fix

Upgrade to a fixed version: curl 8.21.0. Check the vendor advisory for mitigations.

References

https://curl.se/docs/CVE-2026-8926.html
https://curl.se/docs/CVE-2026-8926.json
https://hackerone.com/reports/3735184
https://hackerone.com/reports/3735184

Get alerted when CVE-2026-8926 or the next vulnerability affects your stack