This vulnerability (CVE-2026-12064) arises from a disconnect between the curl tool layer and libcurl when a schemeless URL is combined with the --proto-default option set to sftp or scp. The tool layer erroneously infers the URL scheme and omits initializing SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Meanwhile, libcurl honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection using SFTP/SCP as intended. The omission of SSH host verification options by the tool layer results in curl connecting to an SSH remote host without verifying its identity and without raising an error, potentially allowing undetected connections to untrusted hosts.

The impact is that curl may silently connect to an unverified SSH remote host when using schemeless URLs with --proto-default sftp or scp. This bypasses SSH host verification mechanisms, increasing the risk of man-in-the-middle attacks or connections to malicious servers without user awareness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using schemeless URLs combined with --proto-default sftp or scp in curl to prevent bypassing SSH host verification. Explicitly specifying the URL scheme or avoiding the --proto-default option in these contexts may reduce risk.