CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.58%

CWE

CWE-522

Published

2026-07-03

Last modified

2026-09-17

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-522

Related vulnerabilities

• CVE-2026-32633 — Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
• CVE-2020-37097 — Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)
• CVE-2026-29128 — IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files
• CVE-2025-13478 — Cache Misconfiguration Leading to Cross-User Data Exposure
• CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
• CVE-2026-42869 — SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools
• CVE-2026-56843 — Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated custo
• CVE-2026-52855 — Wings exposes node configuration secrets through egg configuration-file templating

Markdown version · Browse all CVEs