CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

• CWE-522

• https://curl.se/docs/CVE-2026-9079.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2026-9079.jsonVendor Advisory
• https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory

Published

Jul 3, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9072IBM WebSphere Application Server and IBM WebSphere Applicati…9.8
• CVE-2026-9073A flaw was found in foreman-mcp-server. This component utili…6.2
• CVE-2026-9074IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 throu…9.8
• CVE-2026-9076Issue summary: When CMS password-based decryption (RFC 3211 …7.5
• CVE-2026-9077IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote…8.5
• CVE-2026-9078Firefox for iOS displayed specially crafted right-to-left (R…5.4
• CVE-2026-9080Calling `curl_easy_pause()` within the event-based `CURLMOPT…7.3
• CVE-2026-9081IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.1…7.1
• CVE-2026-9082Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-9083A flaw was found in Keycloak. A realm administrator with the…4.9
• CVE-2026-9084MISP’s OIDC authentication plugin allowed automatic linking …6
• CVE-2026-9085Incorrect Permission Assignment for Critical Resource, Impro…8.8