When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential… (CVE-2026-86413)

This vulnerability occurs when curl is configured to use an ambient user for Negotiate authentication in an initial transfer and is also set to follow HTTP redirects. Under these conditions, curl may inadvertently pass its authentication credentials to a redirected URL that belongs to a different origin, potentially exposing sensitive credential information to an unintended party.

The impact is the unintended disclosure of authentication credentials to an unrelated second origin during HTTP redirects. This could lead to credential leakage and unauthorized access if the redirected destination is malicious or compromised. No information about active exploitation or CVSS score is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling automatic redirect following when using Negotiate authentication with ambient users or carefully control redirect behavior to prevent credential leakage.