CVE-2026-8927

mediumpriority · track · 0OT risk · elevatedEPSS 0.005 · 43 %ileCHDEEUFRUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.50% (43rd) EPSS

CVSS 5.3 · medium

Is it mine?

192 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · cert_bund · mettler_toledo_psirt

EPSS · scored 2026-10-27

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRTU500 series CMU Firmwarecisa_csaf_ot
Update to CMU Firmware version 13.9.1
MitigationRTU500 series CMU Firmwarecisa_csaf_ot
Follow general mitigation factors/workarounds
No fix availableLabX Standardmettler_toledo_psirt
This vulnerability will be fixed in the upcoming releases

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.3–9.1

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 3.9 · impact 5.2

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Mettler-Toledo PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-294USprimaryCWE-294USCWE-294US

affected products (192)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM AIX 7.3all versionscert_bundDEcpe:/o:ibm:aix:7.3
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM MQ Operatorall versionscert_bundDEcpe:/a:ibm:mq:operator
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat JBoss Core Servicesall versionscert_bundDEcpe:/a:redhat:jboss_core_services:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
Meinberg LANTIME< V7.10.013cert_bundDE
Open Source cURL< 8.21.0cert_bundDE
Splunk Splunk Enterprise< 10.0.10cert_bundDE
Splunk Splunk Enterprise< 10.2.7cert_bundDE
Splunk Splunk Enterprise< 10.4.3cert_bundDE
Splunk Splunk Enterprise< 9.4.15cert_bundDE

showing 20 of 192

advisories (7)

Vendor and ecosystem advisories describing this.

VDE-2026-088METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.42026-08-20csaf · mettler_toledo_psirtCH
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
WID-SEC-W-2026-2065cURL: Mehrere SchwachstellenDeutsch2026-06-24csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.
ICSA-26-293-05Hitachi Energy RTU500 Product2026-09-01icsa · cisa_csaf_otUS
Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
CERTFR-2026-AVI-1390Multiples vulnérabilités dans Tenable Network MonitorFrançais2026-10-27vendor · certfrFR
CURL-CVE-2026-8927env-set cross-proxy Digest auth state leak2026-06-24vendor · osvUS
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund mettler_toledo_psirt cisa_csaf_ot certfr osv NVD CVE.org MITRE

published 2026-07-03modified 2026-07-07

related (341)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-27348US	critical9.8OT critical	99.2% (100th)	KEV	2024-04-22
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended t…
CVE-2023-23397US	critical9.8OT critical	97.2% (100th)	KEV	2023-03-14
Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2017-3191US	critical9.8OT high	62.5% (99th)	—	2017-12-16
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remot…
CVE-2024-3596US	critical9.0OT high	14.9% (97th)	Exploit	2024-07-09
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot…
CVE-2017-6823US	high8.8OT high	8.04% (95th)	Exploit	2017-03-12
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.

+336 more

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan