CVE-2026-94266

CVSS 7.5 (high) · published 2026-10-20

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Weakness: CWE-522

Source: NVD CVE-2026-94266

References

• https://curl.se/docs/CVE-2026-94266.html
• https://curl.se/docs/CVE-2026-94266.json
• https://hackerone.com/reports/4041053
• https://hackerone.com/reports/4041053

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.