When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the… (CVE-2026-94265)

CVE-2026-94265 describes a flaw in curl's handling of HTTP redirects that include userinfo components. When such a redirect occurs, curl mistakenly preserves and retransmits the HTTP Negotiate authentication state from the original host. This enables an attacker controlling the redirect target to coerce curl into sending a new Kerberos ticket, generated with the client's ambient identity, to an untrusted server. This bypasses the intended domain-scoping protections that restrict Kerberos ticket transmission unless the --location-trusted flag is explicitly used.

An attacker can exploit this vulnerability to obtain a freshly minted Kerberos ticket from the client and send it to an untrusted third-party host. This undermines the domain-scoping restrictions designed to prevent credential leakage during HTTP redirects, potentially leading to unauthorized access or impersonation within Kerberos-authenticated environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing HTTP redirects to URLs containing userinfo components or use the --location-trusted option cautiously. Monitoring vendor communications for updates is recommended.