Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CMake before 3.30.3-14 may expose password during redirects
published 5 months ago
Summary
CMake versions earlier than 3.30.3-14 can accidentally send a saved password to a different website when it follows an HTTP redirect while using a .netrc file for credentials. This could let the second site see the password intended for the first site. Upgrade CMake to the latest version or stop using .netrc files with automatic redirects to prevent the leak.
What to do
- Update azure cmake to version 3.30.3-14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | cmake |
< 3.30.3-14 Fix: upgrade to 3.30.3-14
|
Original advisory text
CVE-2026-6429 affecting package cmake for versions less than 3.30.3-14
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
References
Timeline
Published13 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-86688 · OSV
Track software like this
Free during beta