---
schema_version: '1.0'
id: security-20260705-167342
url: https://osv.dev/vulnerability/CURL-CVE-2026-3783
url_hash: 16734281878026211317e671f0769ec8a765a386765726f30ccd2658ef914706
canonical_url: https://osv.dev/vulnerability/CURL-CVE-2026-3783
source: osv:osv
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-3783
- CURL-CVE-2026-3783
- severity:Medium
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-03-11T08:00:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:37:46Z'
status: published
content_hash: e37c1e6378738c956b21cb6e6b7edf06af6f7684d90a604910947bea75a10d16
license_note: full
summary: token leak with redirect and netrc
summary_source: rss
summary_en: token leak with redirect and netrc
entities:
- name: GitHub
  type: organization
- name: Token-based Rate Limiting
  type: method
- name: earlyappleleaks
  type: person
- name: converge with
  type: UNKNOWN
key_facts: []
related: []
related_auto:
- name: Anonymous
  type: organization
  weight: 1.0
- name: AirPods
  type: artifact
  weight: 1.0
- name: Claude Code
  type: artifact
  weight: 1.0
- name: セッション漏洩
  type: event
  weight: 1.0
- name: local-llm
  type: content
  weight: 1.0
title: 'CVE-2026-3783: token leak with redirect and netrc'
---

# CVE-2026-3783: token leak with redirect and netrc

## TL;DR
token leak with redirect and netrc

## Key Points
- cve / CVE-2026-3783 / CURL-CVE-2026-3783 / severity:Medium / https://github.com/curl/curl / GIT

## Details
**Severity:** Medium
**Advisory:** CURL-CVE-2026-3783 (CVE-2026-3783)

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a redirect to a second URL, curl could leak that token to the second
hostname under some circumstances.

If the hostname that the first request is redirected to has information in the
used .netrc file, with either of the `machine` or `default` keywords, curl
would pass on the bearer token set for the first host also to the second one.

_Data: OSV.dev (upstream: osv) — https://osv.dev/vulnerability/CURL-CVE-2026-3783_

## Source
元記事: [CVE-2026-3783: token leak with redirect and netrc](https://osv.dev/vulnerability/CURL-CVE-2026-3783) — published 2026-03-11T08:00:00Z