libcurl could accidentally return a URL for curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL… (CVE-2026-94266)

The libcurl library has a flaw where the curl_easy_getinfo() API call for CURLINFO_EFFECTIVE_URL may inadvertently expose credentials within the returned URL. This occurs despite the fact that neither the URL initially provided to libcurl nor any redirected URL contained credentials. This could lead to unintended disclosure of sensitive information when retrieving the effective URL after a transfer.

The impact is the accidental exposure of credentials embedded in the URL returned by curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL. This could lead to leakage of sensitive authentication data if the returned URL is logged, displayed, or otherwise exposed. No information about active exploitation or broader system compromise is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying on curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL in contexts where credential exposure would be problematic.