CVE-2026-9547 Details
Description
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
A vulnerability exists in libcurl versions 7.69.0 through 8.20.0, when the application uses the libssh backend for SCP or SFTP transfers and the CURLOPT_SSH_KEYFUNCTION callback. In this scenario, libcurl may inadvertently accept an untrusted server. The issue arises when a server's host key type does not align with the key type recorded in the known_hosts file for that host. Instead of rejecting the mismatch, the callback mechanism fails to enforce the validation properly, allowing the connection to proceed without warning, which could lead to a man-in-the-middle attack.
Users are advised to upgrade curl and libcurl to version 8.21.0, or to apply the patch available in the curl GitHub repository and rebuild. Alternatively, curl can be built with libssh2 instead of libssh.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3751712 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-9547.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-9547.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3751712 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.69.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |