Cyber Resilience

CVE-2026-9079

Exposed Creds in Haxx Curl 8.8.0 – 8.21.0

Public PoCExposed Creds
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0058 44th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-9079 is a critical-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Haxx Curl. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Why these techniques?

Vulnerability prevents clearing of proxy auth credentials, leaving them available for unintended reuse in transfers (unsecured credentials).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1552 Unsecured Credentials Credential Accessconfidence: HIGH
Failure to clear proxy credentials leaves authentication material in memory for subsequent use.
T1552.004 Private Keys Credential Accessconfidence: MEDIUM
Proxy credentials may be stored or reused as private keys or tokens if not properly cleared.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8926Same product: Haxx Curl
CVE-2026-3783Same product: Haxx Curl
CVE-2026-6253Same product: Haxx Curl
CVE-2026-11856Same product: Haxx Curl
CVE-2026-8927Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2026-9545Same product: Haxx Curl
CVE-2025-15224Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl

Affected Assets

haxx
curl
8.8.0 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SC-23 Session Authenticity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V11.3.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces that proxy-auth credentials are cleared exactly when the application requests, preventing their reuse on subsequent transfers.

prevent

Ensures session authenticity by requiring fresh authentication material for each new connection, mitigating stale credential leakage.

detect

Verifies software integrity so that any unauthorized retention of credentials can be detected through integrity checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 full match
prevents

Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.

PR.DS-02 full match
prevents

Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.

PR.AA-01 mostly match
prevents

Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.

PR.AA-04 mostly match
prevents

Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.

PR.AA-03 partial match
prevents

Authentication policies can enforce stronger credential handling yet address only verification, not storage or transit protection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.

prevents

Protecting secret and private keys against disclosure and unauthorized use decreases the exposure of credentials that are stored or transmitted in recoverable form.

prevents

Forbidding clear-text transmission and display of passwords, plus the use of stronger alternatives to passwords, prevents credentials from being obtained or reused by attackers.

prevents

Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.

prevents

Contractual clauses that survive termination help ensure that credentials and other secrets are not retained or misused after employment ends.

prevents

Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.

References