Tools AI-Found Vulnerability Register aifv-0095
Register entry
curl: redirect to SFTP or SCP bypasses host verification
- CVE
- CVE-2026-86410
- Project
- curl
- Component
- curl command-line tool
- Finder
- AISLE
- Autonomy
- AI-assisted audit with human report review, according to AISLE
- Evidence tier
- Claim outside the record
- Assigner
- curl
- Severity
- Low (curl vendor rating)
- Confidence
- SINGLE
What happened
A redirect from HTTPS to SFTP or SCP could omit requested SSH host checks. curl rates the issue Low.
Credit as recorded: Stanislav Fort (Aisle Research). The vendor credits Stanislav Fort (Aisle Research). The first fixed main release was 8.23.0 on 14 October 2026; public disclosure followed on 14 October. AISLE attributes the finding to its AI-assisted audit. The vendor advisory names the human researcher, so machine involvement is recorded as an external claim. Date basis: vendor advisory publication.
Sources
- curl vendor advisorycurl.se/docs/CVE-2026-86410.html
- AISLE account of the auditaisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026