CVE-2026-7168

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

• CWE-294

• https://curl.se/docs/CVE-2026-7168.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2026-7168.jsonVendor Advisory
• https://hackerone.com/reports/3697719Exploit, Issue Tracking
• http://www.openwall.com/lists/oss-security/2026/04/29/14Mailing List, Patch
• https://hackerone.com/reports/3697719Exploit, Issue Tracking

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7162Successful exploitation of the integer overflow vulnerabilit…7.8
• CVE-2026-7163A vulnerability in the assisted-service REST API, an optiona…5.5
• CVE-2026-7164Incorrect packet validation allowed unbounded recursion pars…7.5
• CVE-2026-7165The vulnerability is present in the ‘/addJugador’ endpoint: …9.4
• CVE-2026-7166Vulnerability involving the exposure of sensitive data provi…9.2
• CVE-2026-7167The vulnerability arises when the system fails to properly v…6.9
• CVE-2026-7177A security flaw has been discovered in ChatGPTNextWeb NextCh…7.3
• CVE-2026-7178A weakness has been identified in ChatGPTNextWeb NextChat up…7.3
• CVE-2026-7179A security vulnerability has been detected in OSPG binwalk u…5.3
• CVE-2026-7182Diagram's export module is vulnerable to Path Traversal in s…9.2
• CVE-2026-7183A vulnerability has been found in aligungr UERANSIM up to 3.…5.5
• CVE-2026-7184Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…6.5