CVE-2026-7168

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

• CWE-294
• CWE-294

• https://curl.se/docs/CVE-2026-7168.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2026-7168.jsonVendor Advisory
• https://hackerone.com/reports/3697719Exploit, Issue Tracking
• https://www.openwall.com/lists/oss-security/2026/04/29/14Mailing List, Patch
• https://hackerone.com/reports/3697719Exploit, Issue Tracking

Published

May 13, 2026

Last Modified

Sep 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71647An issue in EGO-Planner-v2 All versions up to commit 5c99a95…7.5
• CVE-2026-7165The vulnerability is present in the ‘/addJugador’ endpoint: …9.4
• CVE-2026-7166Vulnerability involving the exposure of sensitive data provi…9.2
• CVE-2026-7167The vulnerability arises when the system fails to properly v…6.9
• CVE-2026-71675An issue in Open5GS v.2.7.0 allows a remote attacker to caus…7.5
• CVE-2026-71676Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a re…7.5
• CVE-2026-7169a vulnerability involving an unchecked search path element i…7.5
• CVE-2026-71693Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2026-71694An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile …8.8
• CVE-2026-7177A security flaw has been discovered in ChatGPTNextWeb NextCh…7.3
• CVE-2026-7178A weakness has been identified in ChatGPTNextWeb NextChat up…7.3
• CVE-2026-7179A security vulnerability has been detected in OSPG binwalk u…5.3