GHSA-vw2x-3w8j-rq82
A vulnerability in curl causes it to potentially use the wrong password from a .netrc file when a URL with a username but no password is specified. If the .netrc file contains credentials for multiple users on the same host, curl may mistakenly use the password of a different user than the one in the URL. This can lead to unintended credential disclosure or misuse.
AI Analysis
Technical Summary
CVE-2026-8926 describes a flaw in curl's handling of .netrc files when a URL includes a username without a password. In such cases, curl may incorrectly select and use the password of another user listed in the .netrc file for the same host if there is no exact match for the specified username. This behavior can cause curl to send credentials that do not belong to the intended user.
Potential Impact
The vulnerability can result in curl sending the wrong user's password to a server, potentially exposing credentials or causing unauthorized access if the server accepts the incorrect credentials. This misbehavior undermines the security assumptions of user-specific authentication via .netrc files.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid combining .netrc usage with URLs specifying usernames without passwords or carefully manage .netrc entries to prevent ambiguous matches.
GHSA-vw2x-3w8j-rq82
Description
A vulnerability in curl causes it to potentially use the wrong password from a .netrc file when a URL with a username but no password is specified. If the .netrc file contains credentials for multiple users on the same host, curl may mistakenly use the password of a different user than the one in the URL. This can lead to unintended credential disclosure or misuse.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8926 describes a flaw in curl's handling of .netrc files when a URL includes a username without a password. In such cases, curl may incorrectly select and use the password of another user listed in the .netrc file for the same host if there is no exact match for the specified username. This behavior can cause curl to send credentials that do not belong to the intended user.
Potential Impact
The vulnerability can result in curl sending the wrong user's password to a server, potentially exposing credentials or causing unauthorized access if the server accepts the incorrect credentials. This misbehavior undermines the security assumptions of user-specific authentication via .netrc files.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid combining .netrc usage with URLs specifying usernames without passwords or carefully manage .netrc entries to prevent ambiguous matches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vw2x-3w8j-rq82
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-8926"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a483cb427e9c79719d81f53
Added to database: 07/03/2026, 22:50:28 UTC
Last enriched: 07/03/2026, 23:02:29 UTC
Last updated: 07/04/2026, 00:31:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.