CVE-2026-3783 curl CVE debrief

Who should care

Defenders and administrators using curl in their environment should assess exposure and prioritize patching. This includes verifying curl version and patch level, assessing exposure of OAuth2 tokens, and monitoring for potential token leaks. The vulnerability affects curl users who use OAuth2 bearer tokens in their environment.

Why it matters

CVE-2026-3783 is a medium-severity vulnerability in curl that could lead to OAuth2 bearer token leaks under certain circumstances. Defenders and administrators using curl should assess exposure, prioritize patching, and monitor for potential token leaks.

• Verify curl version and patch level
• Assess exposure of OAuth2 tokens
• Monitor for potential token leaks
• Update inventory with patched curl versions

Technical summary

The curl project has fixed a vulnerability where an OAuth2 bearer token could be leaked to a second hostname when a redirect occurs. This issue arises when an OAuth2 bearer token is used for an HTTP(S) transfer that performs a redirect to a second URL. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. The vulnerability has a medium severity and is tracked as CVE-2026-3783.

Defensive priority

Assess and verify curl usage, prioritize patching for exposed systems

Recommended defensive actions

• Assess curl usage in your environment
• Verify and apply patches from curl
• Monitor for potential token leaks
• Verify curl version and patch level
• Assess exposure of OAuth2 tokens
• Update inventory with patched curl versions
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The curl project has released advisories and patches. Evidence is limited to public CVE and NVD information. Defenders should verify curl version and patch level, assess exposure of OAuth2 tokens, and monitor for potential token leaks. The vulnerability affects curl users who use OAuth2 bearer tokens in their environment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.