CVE-2026-6253: Proxy Credential Leak in cURL 8.12.0–8.19.0

An attacker could exploit this vulnerability by crafting a malicious URL that triggers a redirect from one scheme (e.g., HTTP) to another (e.g., HTTPS), leveraging the configured proxy settings. This would cause cURL to forward the credentials of the first proxy to the second proxy, even if the second proxy does not require authentication. The potential impact is significant, as it could allow an attacker to gain unauthorized access to resources protected by the second proxy, potentially leading to data breaches or system compromise. The blast radius depends on the privileges and access granted by the second proxy. This is particularly concerning in environments with strict proxy authentication policies.

1. Gereserveerd2026-04-13
2. Gepubliceerd2026-05-13
3. EPSS bijgewerkt2026-05-13

The primary mitigation is to upgrade to cURL version 8.19.1 or later, which addresses the credential forwarding issue. If upgrading is not immediately feasible, consider implementing stricter proxy authentication policies to minimize the impact of a potential credential leak. Specifically, ensure that all proxies require authentication and that credentials are not inadvertently passed between proxies. Network segmentation can also limit the lateral movement potential if this vulnerability is exploited. Review proxy configurations to ensure proper authentication and authorization policies are in place.