Loading vulnerability…
CVE-2026-86410 is an SSH host verification bypass in the curl command-line tool affecting versions earlier than 8.23.0. The tool configures SSH host verification options for direct SFTP and SCP transfers but fails to apply those options when reaching these protocols through a redirect. Consequently, a redirected transfer can proceed without the intended verification of the remote SSH server's identity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced by an Ubuntu local security check covering curl packages. No individual technical description or vulnerability-specific exploit availability is provided.
A logic flaw in the curl command-line tool causes SSH host verification options not to be set when SFTP or SCP connections result from following redirects. The advisory rates it Low severity, with a CVSS v3.1 score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), indicating limited confidentiality and integrity impacts and no availability impact. Fixes are pending for the listed Amazon Linux packages.
A critical vulnerability affecting curl and related packages covered by Echo's security update. Its CVSS v3 score is 9.1, indicating network exploitation with low complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. The content does not describe the underlying flaw. The vulnerability and patch were published on October 14, 2026.
A flaw affecting SFTP and SCP redirects allows a redirected connection to skip SSH host verification, undermining confirmation of the remote server's identity.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.