CVE-2026-12064: proto-default skips SSH verification

Summary

When a user invokes curl with a schemeless URL and --proto-default sftp (or scp), the tool layer guesses the URL is HTTP and skips setting SSH security options (CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, CURLOPT_SSH_KNOWNHOSTS). However libcurl's runtime correctly applies --proto-default and connects via SFTP/SCP. The result is that --hostpubsha256, --hostpubmd5, and --knownhosts are silently ignored — curl connects to an unverified SSH host and sends authentication credentials.

A network MITM attacker running a rogue SSH server captures the victim's password or triggers key-based auth against an attacker-controlled host, while curl reports no host key error.

Affected version

Introduced in commit f97d372703 (2025-05-15, "tool_operate: move config2setopts to separate file"), first released in curl 8.14.0. Present through current master (8.21.0-DEV).