CVE-2026-12064 Details
Description
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
A vulnerability exists in the curl command-line tool, specifically in versions 7.81.0 prior to 8.21.0, that allows for SSH host verification to be bypassed when using schemeless URLs with the '--proto-default' option set to SFTP or SCP. This issue arises because the tool layer incorrectly infers the URL scheme, leading to the omission of critical SSH security options. As a result, curl can connect to unverified SSH hosts, potentially allowing for man-in-the-middle attacks where an attacker could intercept credentials or authentication keys.
Users are advised to upgrade curl and libcurl to version 8.21.0. Alternatively, the patch can be applied to earlier versions and the tool rebuilt. If neither option is feasible, avoid using '--proto-default' with SFTP or SCP.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3797526 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-12064.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-12064.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3797526 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.81.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |