An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by… (CVE-2026-86414)

The vulnerability arises because libcurl misinterprets a proxy's 401 WWW-Authenticate response to a CONNECT request as an authentication challenge from the origin server rather than the proxy. Consequently, libcurl sends the origin's credentials to the proxy, potentially exposing sensitive authentication information to the proxy server. This affects scenarios where libcurl is used with HTTP proxies and authentication mechanisms like Basic or Negotiate/Kerberos.

The impact is the unintended disclosure of origin server credentials to an HTTP proxy. This could allow a malicious or compromised proxy to capture sensitive authentication tokens or passwords, potentially leading to unauthorized access or credential theft. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when using libcurl with untrusted HTTP proxies, especially when using sensitive authentication methods. Consider avoiding proxy use or restricting proxy trust until the issue is resolved.