CVE-2026-19931

Libcurl wrongly reuses an HTTP connection that was set up for a hostname using Negotiate authentication when the initial request to that host was made with empty credentials, so a connection already authenticated as one user can be handed to a different user's request (tracked as CWE-488, Exposure of Data Element to Wrong Session). The flaw is triggered when a client first contacts a host over Negotiate (Kerberos/SPNEGO) HTTP authentication with no credentials, and then subsequent requests as different users are sent over that reused, already-authenticated connection. An attacker gains cross-user identity mixups: user B's requests travel over user A's authenticated connection, so data can be disclosed to, or acted on under, the wrong identity, with the CVSS vector rating confidentiality, integrity and availability impact all high and the flaw critical (9.8) with no privileges or user interaction required. Any application or tool that uses libcurl is affected when it performs Negotiate HTTP authentication for multiple users against the same host; this includes the curl command-line tool and the very large ecosystem of operating systems and products that bundle or embed libcurl. No public proof of concept or in-the-wild exploitation is known, it is not in CISA KEV, and EPSS currently estimates a 0.8 percent probability of exploitation within 30 days.

What to do: Upgrade curl/libcurl to the fixed release named in the curl project's security advisory, and audit which installed or embedded libcurl builds your estate carries. As mitigations, avoid making Negotiate-authenticated requests with empty credentials, or prevent connection reuse (for example, use fresh connections per user or disable the connection cache) when multiple users authenticate against the same host. Deployments that never use Negotiate/Kerberos HTTP authentication are not practically affected.