AWS SigV4 Authentication Issue in cURL by Curl Project
CVE-2026-86409
Currently unrated
What is CVE-2026-86409?
An issue arises when the CURLOPT_AWS_SIGV4 option is set to NULL. This action does not effectively disable AWS SigV4 authentication as documented, leading to unauthorized transmissions. Through this misconfiguration, any subsequent data transfer using the same handle continues to transmit an Authorization: AWS4-HMAC-SHA256 header to specified URLs, inadvertently leaking sensitive state information and exposing the application to potential misuse.
Affected Version(s)
curl 8.21.0
curl 8.20.0
curl 8.19.0