curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse

🗓️ 19 Aug 2026 13:28:18Reported by RedHatType

redhat🔗 access.redhat.com👁 2 Views

Authentication bypass in libcurl via incorrect HTTP Negotiate connection reuse.

Reporter	Title	Published	Views	Family All 122
IBM Security Bulletins	Security Bulletin: IBM WinCollect Agent is vulnerable to using components with known vulnerabilities	6 Jul 202613:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability impacts AIX due to cURL libcurl (CVE-2026-5545).	30 Jun 202613:43	–	ibm
attackerkb	CVE-2026-5545	13 May 202608:27	–	attackerkb
AlpineLinux	CVE-2026-5545	13 May 202608:27	–	alpinelinux
BDU FSTEC	The vulnerability of the software for interacting with servers via cURL, related to incorrect session duration, allows attackers to gain unauthorized access to protected information.	15 Jul 202600:00	–	bdu_fstec
Broadcom	Multiples vulnerabilities in Curl	28 Jul 202600:00	–	broadcom
CBLMariner	CVE-2026-5545 affecting package curl for versions less than 8.11.1-8	16 Jun 202623:45	–	cbl_mariner
CBLMariner	CVE-2026-5545 affecting package cmake for versions less than 3.30.3-14	16 Jun 202623:45	–	cbl_mariner
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	1 Oct 202600:00	–	nessus
Tenable Nessus	Curl 7.10.6 < 8.20.0 Wrong Reuse of HTTP Negotiate Connection	1 May 202600:00	–	nessus

Vulners

Node

AND

redhat jboss_core_servicesRange<1.0

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-5545
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.se/docs/CVE-2026-5545.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-5545
cve	www.cve.org/CVERecord

14 Oct 2026 19:15Current

7High risk

Vulners AI Score7

CVSS 3.16.5

EPSS0.0051

SSVC

libcurl authentication bypass HTTP Negotiate connection reuse unauthorized access information disclosure