When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Jun 18, 2026 | Jan 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curl | May 20, 2026 | May 20, 2026 |
| Freebsd | — | Upgrade curl | Mar 12, 2026 | Mar 11, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade curlUpgrade libcurl | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libcurlUpgrade curl | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jan 7, 2026 |
| Ubuntu | — | Upgrade libcurl4-nss-devUpgrade libcurl4t64Upgrade libcurl4Upgrade libcurl4-gnutls-devUpgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl4-openssl-devUpgrade libcurl3-nssUpgrade libcurl3t64-gnutls | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub