CVE-2026-19931

Executive Summary

CVE-2026-19931 is a connection-state flaw in libcurl (CWE-488, Exposure of Data Element to Wrong Session) in which a connection that was previously authenticated for one hostname via HTTP Negotiate authentication is wrongly reused for a subsequent request to that same hostname when the later request is issued with empty credentials. Because existing authenticated connection state is reused instead of negotiated, a request belonging to user B can be transmitted over a connection that was authenticated as user A — a cross-principal session exposure affecting both confidentiality and integrity. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and any application, service, proxy, or automation pipeline that uses libcurl with Negotiate authentication against a shared hostname is potentially in scope.

Technical Analysis

The defect is a session-binding failure rather than a memory-safety bug. HTTP Negotiate authentication (RFC 4559, carried over SPNEGO/GSS-API — typically Kerberos or NTLM in practice) authenticates a connection, and, after a successful handshake, the server treats subsequent requests on that TCP connection as belonging to the authenticated principal. Correct client behavior is that authentication state is bound to the security context that established it and must not be silently reused for a different principal. Per the NVD description, libcurl "wrongly reuse[s] an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials." When the original request was performed with empty credentials — meaning no credential material was supplied — the resulting connection setup still becomes eligible for reuse against that hostname. A later request that also uses empty credentials (or that is otherwise not explicitly re-authenticated) can therefore be dispatched over the connection that a prior, different user had already authenticated as user A.

The impacted component is libcurl's connection pool and its Authentication/Negotiate handling for HTTP. The vulnerability class per CWE-488 is exposure of a data element to the wrong session: the "data element" is the authenticated session context, and the "wrong session" is user B's request. Reachability requires (a) the Negotiate authentication scheme to be enabled and negotiated, (b) an initial request to a given hostname using empty credentials, (c) connection reuse (keep-alive/pooling) against that same hostname, and (d) a subsequent request arising from a different principal's context. Note that CVSS AV:N/AC:L/PR:N/UI:N indicates the attack is network-reachable and requires no privileges or user interaction from the attacker's perspective; the practical precondition is that a victim environment is conducting multi-principal Negotiate traffic through a shared libcurl-based client. No function names, buffer lengths, or memory-corruption details are provided in the source data, and none are asserted here. There is no evidence of a memory-safety component; the issue is logical state confusion.

Exploitation Scenarios

The following chain is derived strictly from the NVD description and the vulnerability class; no specific internal function names or code paths from the upstream patch are asserted.

1. Reconnaissance / target identification. The attacker identifies a service or application tier that uses libcurl to make outbound HTTP requests with Negotiate (SPNEGO/Kerberos) authentication enabled against a shared hostname, and that multiplexes requests from more than one principal (for example, a multi-tenant backend, an API gateway, a job runner, or a hosted integration/automation platform). A public PoC is reported as available, lowering the barrier to identifying candidate targets.

2. Triggering the flaw class. The vulnerable pattern is established by an initial request to the hostname performed with empty credentials. A Negotiate-capable connection setup for that hostname is then available for reuse. When a subsequent request to the same hostname is issued from a different principal's context without re-establishing its own authenticated session, libcurl reuses the prior connection setup instead of negotiating credentials for the second principal.

3. Payload / execution. The second principal's HTTP request is transmitted over the connection that user A previously authenticated. The server processes the request in user A's authenticated context. The attacker's objective at this stage is to have malicious or unauthorized requests served under the victim principal's identity — or to have the victim's request performed under a different identity — without needing to possess that principal's credentials themselves.

4. Post-exploitation impact. Based on CVSS C:H/I:H/A:H, the outcomes are unauthorized access to data the connection's authenticated principal is entitled to (confidentiality) and actions performed as that principal (integrity), all over a network-accessible path with no privileges or user interaction required of the attacker (PR:N/UI:N). Session/log attribution can be corrupted because the server-side audit trail attributes activity to the wrong principal.

"Confirmed public PoC" status is reported; targeted testing should be performed only in authorized environments.

Impact Assessment

Impact is high on both confidentiality and integrity, with no availability impact per the vector (C:H/I:H/A:H, A:N). The adjacent CVSS attributes are AV:N (network-exploitable), AC:L (no race or special conditions assumed by the vector), PR:N/UI:N (no attacker privileges or victim interaction required), S:U (impact scoped to the vulnerable component's security authority). Business impact centers on identity confusion across shared credentialed connections: cross-tenant or cross-user data disclosure, unauthorized state-changing operations performed as another principal, and corrupted access logs that attribute actions to the wrong identity — which directly impedes incident response and compliance attestation. Blast radius is proportional to fan-out: any libcurl-based client, agent, gateway, or service that (i) negotiates HTTP Negotiate authentication and (ii) pools/reuses connections across principals on a shared hostname is potentially affected. EPSS is 0.00788 (54.1st percentile), indicating modest short-term exploitation likelihood in the wild despite the critical base score; CISA KEV status is NO. The exposed surface is not a remote listening service of curl itself but every application embedding the library.

Detection Guidance

Sigma Rule

title: Suspicious HTTP Negotiate Authentication Connection Reuse on Shared Hostname id: 8f2c1a44-3b6e-4c9d-9a77-2e5d0b6f1c31 status: experimental description: Detects curl/libcurl processes negotiating HTTP Negotiate (SPNEGO) authentication against a shared hostname where empty credentials are supplied, consistent with CVE-2026-19931 connection-state reuse. references:

• https://nvd.nist.gov/vuln/detail/CVE-2026-19931 author: valtersit.com date: 2026-01-01 tags:
• attack.t1190
• attack.credential_access logsource: category: process_creation product: linux detection: selection_negotiate: CommandLine|contains:
  • 'negotiate'
  • 'Negotiate' selection_curl: Image|endswith:
  • '/curl'
  • '\curl.exe' selection_empty_creds: CommandLine|contains:
  • '--user ":"'
  • '--user :'
  • '-u ":"' condition: selection_curl and (selection_negotiate or selection_empty_creds) fields:
• Image
• CommandLine
• User
• ParentImage falsepositives:
• Legitimate scripts deliberately performing anonymous Negotiate probes
• Health checks using empty credentials against Kerberos-protected endpoints level: medium

YARA Rule

rule CVE_2026_19931_Curl_Negotiate_ConnReuse
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of libcurl artifacts consistent with CVE-2026-19931 Negotiate empty-credential connection reuse"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19931"
        date = "2026-01-01"
        severity = "high"
    strings:
        $nego1 = "Negotiate" ascii wide nocase
        $nego2 = "WWW-Authenticate: Negotiate" ascii wide nocase
        $nego3 = "Authorization: Negotiate" ascii wide nocase
        $empty1 = "--user \":\"" ascii
        $empty2 = "CURLOPT_USERPWD" ascii
        $reuse1 = "reuse" ascii nocase
        $reuse2 = "connection" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (2 of ($nego*)) and
        (1 of ($empty*)) and
        (1 of ($reuse*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19931 libcurl Negotiate empty-credential connection reuse attempt"; flow:established,to_server; http.request_header; content:"Authorization|3a 20|Negotiate"; http.header_names; content:"Authorization"; http.header_names; pcre:"/^Authorization\x3a\sNegotiate\s(?:\r\n|$)/mi"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-19931; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19931; sid:202619931; rev:1;)

Elastic Detection

process where event.type == "start" and process.name in ("curl", "curl.exe", "libcurl") and (process.command_line : "Negotiate" or process.command_line : "negotiate" or process.command_line : "--user ":"" or process.command_line : "--negotiate")

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=WinEventLog:Security OR sourcetype=proxy) (process_command_line="Negotiate" OR process_command_line="negotiate" OR http_authorization="Negotiate") (process_command_line="--user"":"" OR process_command_line="--negotiate*") | stats count min(_time) as first_seen max(_time) as last_seen values(process_command_line) as commands values(dest_host) as hosts by user, src_ip | where count >= 2 | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen user src_ip hosts count commands

Wazuh OSSEC Rule

5501 curl|curl.exe Negotiate|negotiate|--user ":"|--negotiate CVE-2026-19931: curl/libcurl command negotiated HTTP Negotiate authentication with empty credentials - potential cross-session connection reuse. T1190 authentication_bypass,

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, NVD, asserts a patch, and this is not independently confirmed; no vendor advisory text, fixed version, or commit was provided in the source data). Treat the following as triage guidance until the official curl security advisory is verified.

1. Immediate mitigations

• Audit applications and services that embed libcurl and are configured for HTTP Negotiate authentication against shared hostnames. Where Negotiate is not strictly required, disable it (prefer non-connection-bound authentication).
• Avoid issuing requests with empty credentials against Negotiate-protected hostnames, and avoid pooling a Negotiate-authenticated connection across principals. Where possible, force authentication to be re-established per principal/request and disable connection reuse for Negotiate flows.
• Consider isolating multi-principal traffic so that different principals do not share a pooled client instance or a common hostname path.

2. Patch / upgrade steps

• Verify the patch claim against the official curl security advisory and release notes; identify the exact fixed libcurl version once published. Confidence is 2/4 and must not be treated as confirmed.
• Inventory every dependency that bundles libcurl (operating systems, language bindings, container base images, appliances) and upgrade the library rather than only the CLI tool. Rebuild statically linked binaries.
• After upgrading, validate that a Negotiate request with empty credentials no longer reuses a previously authenticated connection for a different principal (targeted functional test in a controlled environment).

3. Long-term hardening

• Add SBOM-driven dependency tracking for libcurl and mandate timely response to curl security advisories.
• Enforce per-principal authentication contexts and least privilege on servers accepting Negotiate, so that connection reuse cannot grant access beyond the originating principal's rights.
• Centralize and correlate authentication logs so that principal attribution anomalies (a request logged under the wrong identity) can be detected quickly.

References

• NVD — CVE-2026-19931: https://nvd.nist.gov/vuln/detail/CVE-2026-19931
• CWE-488 — Exposure of Data Element to Wrong Session: https://cwe.mitre.org/data/definitions/488.html
• RFC 4559 — SPNEGO-based Kerberos and NTLM HTTP Authentication ("Negotiate"): https://www.rfc-editor.org/rfc/rfc4559
• curl project — security advisories and release notes (authoritative source for the fixed version; verify the claimed patch here): https://curl.se/docs/security.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-19931 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on threat activity: No CISA KEV listing, exploit-in-the-wild confirmation, or named threat-actor campaign was provided in the source data. A public PoC is reported; no confirmed campaign attribution is asserted here.

[ API_PRO ] →

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2026-19931/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub