CVE-2026-3783 Details
Description
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.
A vulnerability exists in curl and libcurl versions 7.33.0 through 8.18.0, where an OAuth2 bearer token can be inadvertently leaked to a second URL during an HTTP(S) redirect. This occurs if the first request's redirect target has an entry in the user's .netrc file, specifically under the 'machine' or 'default' keywords. In such cases, curl transmits the bearer token from the initial host to the redirected one. This issue also affects the curl command line tool.
Users are advised to upgrade to curl and libcurl version 8.19.0, apply the patch and rebuild libcurl, or avoid using bearer tokens with redirects.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2026-3783.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-3783.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3583983 | curl | ExploitIssue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/11/2 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | CISA-ADP |
| CWE-522 | Insufficiently Protected Credentials | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.33.0, < 8.19.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | New CVE Received | curl |
| Mar 11, 2026 | CVE Modified | CVE |