CVE-2026-8926: password leak with netrc and user in URL
Last updated 2 July 2026
Other sources
password leak with netrc and user in URL
— Microsoft
When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.21.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10 - Configuration
Avoid using .netrc for curl requests that include a username in the URL (without a password), unless the specified username exactly matches the .netrc entry for that host.
curl .netrc usage = disabled/avoid - Compensating control
Do not rely on credentials via a .netrc file when requesting a URL that includes a username (without a password), because curl could wrongly get and use the password for a different user (e.g., when the URL is https://user@example.com/).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8926?
CVE-2026-8926 has a risk score of 21, indicating a significant severity level.
How do I fix CVE-2026-8926?
To mitigate CVE-2026-8926, avoid using a username in the URL when also using a `.netrc` file for credentials.
What systems are affected by CVE-2026-8926?
CVE-2026-8926 affects the curl tool on Debian systems.
What kind of data might be compromised due to CVE-2026-8926?
CVE-2026-8926 could lead to unauthorized access to passwords for other users specified in the `.netrc` file.
When was CVE-2026-8926 published?
CVE-2026-8926 was published on July 3, 2026.