When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory.

    - fix proxy environment variable change detection (CVE-2026-8927)
    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix proxy connection reuse with wrong credentials (CVE-2026-3784)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)
    - fix schemeless URL handling with --proto-default (CVE-2026-12064)
    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory.

    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55439 advisory.

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)
      * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)
      * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)
      * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55439 advisory.

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55439 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55450 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819)

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    * curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-097fb2e7e9 advisory.

    - fix cross-proxy Digest auth state leak (CVE-2026-7168)
    - fix cross-origin Digest auth state leak (CVE-2026-11856)
    - fix password leak with netrc and user in URL (CVE-2026-8926)
    - fix SSH improper host validation (CVE-2026-9547)
    - fix trailing dot domain super cookie (CVE-2026-8924)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory.

    - Fix trailing dot domain super cookie (CVE-2026-8924)
    - Fix SSH improper host validation (CVE-2026-9547)
    - Fix password leak with netrc and user in URL (CVE-2026-8926)
    - Fix cross-origin Digest auth state leak (CVE-2026-11856)
    - Fix cross-proxy Digest auth state leak (CVE-2026-7168)
    - Fix OCSP stapling bypass with Apple SecTrust (CVE-2026-7009)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3043-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2925-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2926-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21272-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8487-1 advisory.

    Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based     connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use     this issue to cause curl to use an unintended TLS configuration. (CVE-2026-8286)

    Muhamad Arga Reksapati discovered that curl incorrectly reused connections for Negotiate-authenticated     requests when different services were involved. A remote attacker could possibly use this issue to access     resources authenticated for another service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)

    It was discovered that curl incorrectly handled cookie parsing in certain circumstances. A remote attacker     could possibly use this issue to set cookies that would be transmitted to unrelated third-party domains.
    This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8924)

    Joshua Rogers discovered that curl could double-free a GSASL context when handling SASL authentication. A     remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-8925)

    Joshua Rogers discovered that curl could select the wrong password from a .netrc file when a username was     specified in the URL without a password. A remote attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-8926)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. (CVE-2026-8927)

    Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li discovered that curl did not properly clear     proxy authentication credentials when instructed to do so. A remote attacker could possibly use this issue     to obtain sensitive credentials. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9079)

    Joshua Rogers discovered that curl contained a use-after-free when curl_easy_pause() was called within the     event-based socket callback. A remote attacker could possibly use this issue to cause a denial of service     or possibly execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9080)

    Eunsoo Kim discovered that curl could send early data on a resumed TLS session before enforcing     certificate verification failure. A machine-in-the-middle attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9545)

    Joshua Rogers discovered that curl did not properly reject host key type mismatches when using the SSH key     callback for SCP and SFTP transfers. A machine-in-the-middle attacker could possibly use this issue to     impersonate a trusted server. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10,     and Ubuntu 26.04 LTS. (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 7.69.0 prior to 8.21.0. It is, therefore, affected by an improper host validation vulnerability:

  - When a libcurl-based application performs transfers via SCP or SFTP and utilizes the     CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. (CVE-2026-9547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the     `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs     when a server presents a host key type that does not match the specific key type already recorded for that     host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to     properly enforce the restriction, allowing the connection to succeed without warning and risking a     potential man-in-the-middle attack. (CVE-2026-9547)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
338021	Oracle Linux 10 : curl (ELSA-2026-55450)	Nessus	Oracle Linux Local Security Checks	Local	high
338020	Oracle Linux 9 : curl (ELSA-2026-55439)	Nessus	Oracle Linux Local Security Checks	Local	high
337644	AlmaLinux 9 : curl (ALSA-2026:55439)	Nessus	Alma Linux Local Security Checks	Local	high
335981	RockyLinux 9 : curl (RLSA-2026:55439)	Nessus	Rocky Linux Local Security Checks	Local	high
335959	RHEL 9 : curl (RHSA-2026:55439)	Nessus	Red Hat Local Security Checks	Local	high
335952	RHEL 10 : curl (RHSA-2026:55450)	Nessus	Red Hat Local Security Checks	Local	high
334708	Photon OS 5.0: Curl PHSA-2026-5.0-90-0951	Nessus	PhotonOS Local Security Checks	Local	critical
333502	Photon OS 4.0: Curl PHSA-2026-4.0-1061	Nessus	PhotonOS Local Security Checks	Local	critical
333276	Fedora 43 : curl (2026-097fb2e7e9)	Nessus	Fedora Local Security Checks	Local	medium
331599	Fedora 44 : curl (2026-e691fbbfe7)	Nessus	Fedora Local Security Checks	Local	medium
327284	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3043-1)	Nessus	SuSE Local Security Checks	Local	critical
326957	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:2925-1)	Nessus	SuSE Local Security Checks	Local	critical
326933	SUSE SLES15 Security Update : curl (SUSE-SU-2026:2926-1)	Nessus	SuSE Local Security Checks	Local	critical
326418	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21272-1)	Nessus	SuSE Local Security Checks	Local	critical
324983	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : curl vulnerabilities (USN-8487-1)	Nessus	Ubuntu Local Security Checks	Local	critical
323010	libcurl 7.69.0 < 8.21.0 SSH Improper Host Validation	Nessus	Misc.	Local	high
322430	Linux Distros Unpatched Vulnerability : CVE-2026-9547	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-9547

high

Tenable Plugins

high

high

high

high

high

high

critical

critical

medium

medium

critical

critical

critical

critical

critical

high

high