CVE-2022-27774 An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Api.Msrc.Microsoft • February 21, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Curl Affecting Authentication and Credentials Two vulnerabilities in curl have been identified: CVE-2022-22576, which affects versions 7.33.0 to 7.82.0, allowing unauthorized reuse of OAUTH2-authenticated connections, and CVE-2022-27774, affecting versions 4.9 to 7.82.0, which could lead to credential leakage during HTTP(S) redirects. These vulnerabilities impact various SASL-enabled protocols including SMTP(S), IMAP(S), POP3(S), and LDAP(S). 2 sources 53

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

T1041 - Exfiltration Over C2 Channel T1567 - Exfiltration Over Web Service