CVE-2026-9547: curl — Exploit & Fix

Description

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Is your site exposed to CVE-2026-9547?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0051

Probability of exploitation

0.40%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Affected Products

Vendor	Product	Versions
haxx	curl	7.69.0 — 8.21.0

References

Advisories & Patches

https://curl.se/docs/CVE-2026-9547.html https://curl.se/docs/CVE-2026-9547.json

Exploits

https://hackerone.com/reports/3751712 https://hackerone.com/reports/3751712

Frequently Asked Questions

What is CVE-2026-9547? +

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. It has a CVSS v3.1 base score of 7.4 (HIGH).

How severe is CVE-2026-9547? +

CVE-2026-9547 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0051, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-9547? +

CVE-2026-9547 affects products from haxx, specifically: curl. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-9547? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-11856 9.8

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the …

CVE-2026-9079 9.8

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the …

CVE-2026-10536 9.8

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes …

CVE-2026-8925 9.8

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the …

CVE-2026-8924 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public …

CVE-2026-8927 9.1

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication …

CVE-2026-9547