CVE-2026-12064: curl SSH Host Verification Bypass with Schemeless URLs

Technical summary

CVE-2026-12064 exploits a disconnect between curl's command-line tool layer and libcurl's runtime behavior when processing schemeless URLs with `--proto-default sftp` or `--proto-default scp`. The tool layer misinterprets the URL scheme and skips initialization of CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS options. Meanwhile, libcurl correctly honors CURLOPT_DEFAULT_PROTOCOL and establishes the SFTP/SCP connection as intended. The result is an SSH connection without host key verification—no error is raised, leaving the application vulnerable to man-in-the-middle attacks. The vulnerability is classified under CWE-295 (Improper Certificate Validation).

Business impact

An attacker positioned on the network path to an SSH server can intercept curl connections and serve a malicious host key without detection. This is particularly dangerous in automated workflows, CI/CD pipelines, or scripts that use curl for secure file transfer operations. Compromised connections could lead to credential theft, malware injection, or unauthorized data exfiltration. Organizations relying on curl for SFTP/SCP automation should treat this as a high-priority integrity risk.

Affected systems

The vulnerability affects haxx curl. Any system or application using curl versions with this defect and invoking schemeless URLs in combination with `--proto-default sftp` or `--proto-default scp` is at risk. This includes command-line invocations, scripted deployments, and applications that shell out to curl for file transfer operations.

Exploitability

Exploitation requires network-level access to intercept traffic between the client and SSH server (man-in-the-middle position). No user interaction is needed beyond the initial curl invocation with the vulnerable flag combination. The attack is practical in environments where an attacker can control network routing or DNS, such as compromised networks, malicious ISPs, or internal lateral movement scenarios. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects high integrity impact with low complexity and no privileges required.

Remediation

Apply the security update from haxx curl that restores proper SSH host verification initialization in the tool layer when `--proto-default` is used with schemeless URLs. Verify against the official curl advisory for exact patched versions. Until patching is possible, avoid using schemeless URLs with `--proto-default sftp` or `--proto-default scp`; instead, use fully-qualified URLs (e.g., `sftp://host/path`) to ensure the tool layer correctly initializes security options.

Patch guidance

Consult the official haxx curl security advisory for the specific version containing the fix. Update curl to the patched release at your earliest convenience. Test the patched version in a non-production environment first, particularly if curl is embedded in critical automation or file-transfer workflows. Verify that SSH host key verification is now functioning correctly by attempting a connection to an unknown host—curl should now reject it.

Detection guidance

Search logs and scripts for curl invocations using `--proto-default sftp` or `--proto-default scp` in combination with schemeless URLs (those without a scheme prefix like `sftp://`). Monitor for any unexpected SSH connections from curl-based processes, particularly those lacking host key validation warnings or errors. Inspect curl configuration files and automation scripts to identify risky patterns. Endpoint detection tools should flag curl executions with these flag combinations as suspicious.

Why prioritize this

This vulnerability sits at the intersection of silent failure and high-impact attack surface. Unlike many SSH vulnerabilities that raise obvious errors, this one silently bypasses verification, making it easy for adversaries to succeed and hard for defenders to spot. The combination of network-level exploitability, no user interaction required, and integrity-focused impact (perfect for man-in-the-middle attacks) justifies HIGH severity. Organizations automating file transfers or deployments via curl should treat this as an urgent fix.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) network-accessible attack vector with no special privileges or user interaction needed; (2) high integrity impact—attackers can modify or intercept sensitive files in transit; (3) no confidentiality or availability impact, narrowing the scope. The score appropriately captures the real-world danger of silent SSH verification bypass, though organizations with strict file-transfer SLAs may regard this as even more critical.

Frequently asked questions