🚨 CRITICAL - curl .netrc credential confusion leaks wrong user password (CVE-2026-8926) This vulnerability affects curl’s .netrc credential lookup logic when authenticating to a host and the URL supplies a username but no password. The root cause is improper credential selection / authentication context mix-up, where curl can fall back to a different user’s password from the same host’s .netrc entries. An attacker can exploit this by getting a victim to request a crafted URL like https://user@example.com/ (or by controlling/redirecting the target host) in an environment where curl is configured to use .netrc and multiple users exist for that host. Impact includes unintended credential disclosure/use (auth to the wrong account), potential account compromise, and follow-on data access depending on what that misapplied credential can reach. 👉 Affected: curl (when using .netrc; versions not yet specified) | Upgrade to No fix yet - treat as suspicious
Post summary
The post announces a new CVE affecting curl’s .netrc handling, outlining the vulnerability’s mechanics and potential impact, but no exploitation evidence or fixes are available.