CVE-2026-7168General(haxx / curl)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch haxx curl systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

haxx CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Vendor / third-party advisories

https://curl.se/docs/CVE-2026-7168.json

Weakness type (CWE)

CWE-294

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

curl

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked 4d ago at 2 mentions (2026-04-30); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

haxx

Products

curl

Deep dive

Activity timeline8 mentions / 6d

Signal classification3 categories

General

337.5%

Patch

337.5%

Disclosure

225.0%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-29	1	General1
2026-04-30	2	Disclosure1General1
2026-05-02	1	Disclosure1
2026-05-05	1	Patch1
2026-05-11	2	Patch2
2026-06-03	1	General1

Full discourse8 posts

H1 Disclosed - Public Disclosures@h1Disclosed159d
Disclosure
⚡ CVE-2026-7168: cross-proxy Digest auth state leak 👨🏻‍💻 xkilua ➟ curl 🟧 Medium 💰 None 🔗 https://hackerone.com/reports/3697719 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/BxmoIgm9dq
Post summary
The tweet announces CVE‑2026‑7168, a Medium‑severity cross‑proxy Digest authentication state leak, linking to a HackerOne bounty report but providing no exploits, patches, or evidence of active exploitation.
010111.2K
10.2K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya151d
Patch
kusanagi-curl モジュール更新情報 8.20.0-1 https://kusanagi.tokyo/releases/24476/ KUSANAGI 9 を構成している各モジュールのアップデートを行いました。アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.20.0-1 この更新には脆弱性(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2...
Post summary
The kusanagi‑curl module is updated to version 8.20.0‑1, providing patches for the listed CVEs.
0101085
200 followersView on X
H1 Disclosed - Public Disclosures@h1Disclosed156d
Patch
⚡ libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Prox... 👨🏻‍💻 codexxxx ➟ curl 🟧 Medium 💰 None 🔗 https://hackerone.com/reports/3707747 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/hPy4gHl18V
Post summary
The tweet announces that libcurl 8.20.0’s fix for CVE-2026-7168 is incomplete, noting that altering CURLOPT_PROXYPORT still leaks stale proxy data, and it links to a HackerOne bounty report for more detail.
00001376
10.2K followersView on X
Open Source Security mailing list@oss_security162d
General
curl CVE-2026-6253: proxy credentials leak over redirect-to proxy CVE-2026-7009: OCSP stapling bypass with Apple SecTrust CVE-2026-6276: stale custom cookie host causes cookie leak CVE-2026-7168: cross-proxy Digest auth state leak 2/2
Post summary
The post lists several CVE identifiers for curl, each describing a type of credential or state leak, but lacks additional context such as PoC, exploits, patches, or active exploitation details.
00010211
4.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds162d
General
CVE-2026-7168 [ADVISORY] curl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7168
Post summary
The post merely cites CVE-2026-7168 and links to a vulnerability advisory, offering no substantive details or claims beyond that.
0000133
4.0K followersView on X
WindowsForum@windowsforum127d
General
🪟 CVE-2026-7168 is “medium,” but the vibe is still savage: reuse one libcurl handle and Digest Proxy-Authorization can leak between proxies. Admin checklist time—least fun kind of security. https://windowsforum.com/threads/cve-2026-7168-libcurl-digest-proxy-leak-windows-admin-fix-checklist.422028/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #LibcurlVulnerability #Cve20267168 #ProxyHygiene https://t.co/XhmJ5xLEJl
Post summary
The post highlights a medium‑severity vulnerability (CVE‑2026‑7168) where reusing a libcurl handle can leak Digest Proxy‑Authorization credentials between proxies, but no PoC, exploit, or active‑use evidence is provided.
0000040
1.1K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya151d
Patch
kusanagi-curl Module Update 8.20.0-1 https://kusanagi.tokyo/en/releases/24477/ KUSANAGI 9 modules have been updated. The updated modules are as follows: curl 8.20.0-1 This update includes support for vulnerability(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253,...
Post summary
The KUSANAGI 9 module update to curl 8.20.0-1 provides fixes for several CVEs, addressing vulnerabilities such as CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, and CVE-2026-6253.
0000040
200 followersView on X
Autumn Good@autumn_good_35161d
Disclosure
curlで8件の脆弱性 CVE-2026-7168 CVE-2026-7009 CVE-2026-6429 CVE-2026-6276 CVE-2026-6253 CVE-2026-5773 CVE-2026-5545 CVE-2026-4873 Published vulnerabilities for curl/libcurl https://curl.se/docs/security.html
Post summary
The post announces eight new CVE entries for curl/libcurl and directs readers to curl’s official security page.
00000396
6.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haxx	curl	-	-	-

Explore more

Back to dashboard haxx CVEs curl vulnerabilities

What researchers are saying

CVE-2026-7168

WindowsForum[verified]@windowsforumGeneral

The post highlights a medium‑severity vulnerability (CVE‑2026‑7168) where reusing a libcurl handle can leak Digest Proxy‑Authorization credentials between proxies, but no PoC, exploit, or active‑use evidence is provided.

H1 Disclosed - Public Disclosures@h1DisclosedDisclosure

The tweet announces CVE‑2026‑7168, a Medium‑severity cross‑proxy Digest authentication state leak, linking to a HackerOne bounty report but providing no exploits, patches, or evidence of active exploitation.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

The kusanagi‑curl module is updated to version 8.20.0‑1, providing patches for the listed CVEs.

H1 Disclosed - Public Disclosures@h1DisclosedPatch

The tweet announces that libcurl 8.20.0’s fix for CVE-2026-7168 is incomplete, noting that altering CURLOPT_PROXYPORT still leaks stale proxy data, and it links to a HackerOne bounty report for more detail.

Open Source Security mailing list@oss_securityGeneral

The post lists several CVE identifiers for curl, each describing a type of credential or state leak, but lacks additional context such as PoC, exploits, patches, or active exploitation details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely cites CVE-2026-7168 and links to a vulnerability advisory, offering no substantive details or claims beyond that.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

The KUSANAGI 9 module update to curl 8.20.0-1 provides fixes for several CVEs, addressing vulnerabilities such as CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, and CVE-2026-6253.

Autumn Good@autumn_good_35Disclosure

The post announces eight new CVE entries for curl/libcurl and directs readers to curl’s official security page.