A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Curl
  • Curl
Redhat
  • Hummingbird

No data.

Package CPE Advisory Released Date
Red Hat Hardened Images
curl-main-8.23.0-0.1.hum1 cpe:/a:redhat:hummingbird:1 RHSA-2026:82895 2026-10-14T00:00:00Z
References
Link Providers
https://curl.se/docs/CVE-2026-86410.html cve-icon cve-icon
https://curl.se/docs/CVE-2026-86410.json cve-icon cve-icon
https://hackerone.com/reports/3973176 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-86410 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-86410 cve-icon
History

Tue, 20 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure. A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
Title curl: curl: redirect to SFTP or SCP bypasses host verification redirect to SFTP or SCP bypasses host verification
References

Sun, 18 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure.
Title curl: curl: redirect to SFTP or SCP bypasses host verification
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-297
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

threat_severity

Low
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-10-20T19:59:26.502Z

Updated: 2026-10-20T19:59:26.502Z

Reserved: 2026-09-07T12:11:46.874Z

Link: CVE-2026-86410

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T20:17:25.380

Modified: 2026-10-22T17:21:57.293

Link: CVE-2026-86410

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-14T12:00:00Z

Links: CVE-2026-86410 - Bugzilla