A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as… (CVE-2026-86410)

The curl command line tool has a vulnerability where SSH host verification options are set only during direct interactions using SFTP or SCP protocols. However, if curl accesses these protocols as a result of following a redirect, the SSH host verification options are not applied. This flaw could lead to scenarios where SSH host verification is bypassed unintentionally during redirected connections.

The impact is that SSH host verification, which is critical for ensuring the authenticity of the remote host in SFTP or SCP connections, may not be enforced when curl follows redirects. This could potentially allow man-in-the-middle attacks or connections to untrusted hosts without proper verification, reducing the security of SSH-based file transfers initiated via redirects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when using curl with redirects to SFTP or SCP URLs and consider avoiding such redirects or manually verifying host authenticity.