Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-8926: curl Exposes Passwords with .netrc and Username in URL
CURL-CVE-2026-8926
CVE-2026-8926
CVE-2026-8926
Summary
Curl incorrectly retrieves passwords from .netrc files when a username is specified in the URL. This can expose passwords for the wrong user if multiple users are configured for the same host. To prevent this, avoid using .netrc files or ensure that usernames in the URL match the username in the .netrc file.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| curl | curl | <= 8.20.0 |
Original title
When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://[email protected]/`, curl could wrongly get and u...
Original description
When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://[email protected]/`, curl could wrongly get and use the password for
*another* user set in the `.netrc` file for that host if such a one exists and
there is no match for the specified user.
time specifying a URL with a username(without a password), like
`https://[email protected]/`, curl could wrongly get and use the password for
*another* user set in the `.netrc` file for that host if such a one exists and
there is no match for the specified user.
Vulnerability type
CWE-522
Insufficiently Protected Credentials
Published: 3 Jul 2026 · Updated: 23 Jul 2026 · First seen: 24 Jun 2026