curl 8.22 Blocks NTLM Fallback Inside SPNEGO: Test Enterprise Proxy Authentication Before Upgrading

curl 8.22.0, released on 2 September 2026, includes an authentication change described by the curl project as “spnego: block NTLM fallback in SPNEGO negotiation.” Teams that use Negotiate authentication with enterprise HTTP proxies should treat this as a compatibility and security-boundary change, not as a routine transport patch.

The change does not mean that curl removed every form of NTLM support. Explicit NTLM authentication remains a separate mechanism where the build and configuration support it. The important distinction is that a request configured for Negotiate should no longer silently complete by selecting NTLM inside the SPNEGO exchange. That can expose proxy environments that were labeled “Kerberos” even though successful requests depended on fallback.

Why proxy operators should care

Enterprise forward proxies commonly respond with HTTP 407 and one or more Proxy-Authenticate challenges. A client may be configured for Negotiate and obtain credentials from SSPI on Windows or GSSAPI elsewhere. If Kerberos prerequisites are incomplete, an older client path might still authenticate through NTLM fallback inside SPNEGO.

After upgrading, the same request may fail instead of downgrading. That failure can be the intended security outcome, but it still needs an operational plan. Without one, schedulers may rotate proxy endpoints, retry with the same broken identity, consume worker capacity and misclassify the event as an unstable proxy pool.

Separate four authentication decisions

Do not reduce the issue to “NTLM on or off.” Document four independent layers:

1. Which schemes the proxy advertises in its 407 response.
2. Which schemes the application allows for proxy authentication.
3. Which mechanism SPNEGO selects when Negotiate is used.
4. Which identity and service principal are presented for the proxy gateway.

Origin authentication and proxy authentication are also distinct. A destination can return 401 while a proxy returns 407. Record and test them separately so an origin challenge does not hide a proxy regression.

Inventory before the upgrade

For each application, record the runtime curl and libcurl versions, authentication options, operating-system provider, proxy service name, gateway hostname, connection-pool model and credential source. Include command-line tools, embedded libraries, SDKs and container images; the curl executable on a host may not match the libcurl loaded by an application.

Search configuration for Negotiate, any-auth and explicit NTLM modes. Identify whether the organization intends Kerberos-only behavior, permits explicit NTLM for a documented legacy exception, or has no approved NTLM use at all.

Never copy passwords, tickets, keytabs, cookies or authorization headers into the inventory. Store only secret references, credential type, owner and rotation policy.

Build a controlled proxy-authentication matrix

Use a test proxy and identities that your organization controls. Do not experiment against an unrelated corporate gateway or external service. Prepare fixtures for:

• a valid Kerberos ticket and correct proxy service principal;
• no ticket or an expired ticket;
• a service-principal mismatch;
• a proxy advertising Negotiate only;
• a proxy advertising Negotiate and NTLM separately;
• explicit proxy NTLM where policy permits a legacy control;
• wrong credentials and a deliberately rejected account;
• origin 401 after successful proxy 407 handling.

Run each case on the approved pre-upgrade build and curl 8.22.0. Keep gateway, identity, DNS, request, timeout and proxy policy fixed.

Test the full 407 exchange

Record the sequence of status codes and authentication rounds without storing token contents. A useful trace identifies whether the first request is unauthenticated, which challenge schemes are offered, whether a second request carries proxy authorization, and whether the proxy returns 200, another 407 or a bounded client error.

Capture the authentication scheme ultimately used when the client exposes that information. Also record connection ID, gateway endpoint, elapsed authentication time, final curl code and whether application data was sent.

The expected 8.22 result for a Negotiate-only policy is either successful Kerberos authentication or a clear, bounded failure. An opaque success through NTLM inside SPNEGO should not be the acceptance criterion.

Include connection reuse and concurrency

Negotiate and NTLM can be connection-oriented in practical deployments. A one-request test can miss identity reuse, pool contamination and reconnection behavior. Test:

• the first request on a new proxy connection;
• repeated requests for the same identity;
• two identities with isolated pools;
• a connection closed by the proxy after authentication;
• a pooled connection near idle expiry;
• parallel requests that receive 407 at the same time;
• a gateway failover during authentication.

Verify that a connection authenticated for one identity is never reused for another. After failure, queued work should stop or retry within a strict budget rather than creating an authentication storm.

Use the proxy credential rotation guide for secret lifecycle checks and the proxy retry amplification guide to bound repeated 407 attempts.

Diagnose common failures

If curl 8.22 returns 407 where an older build succeeded, do not immediately enable explicit NTLM. Check ticket availability, time synchronization, DNS canonicalization, service-principal naming, realm configuration, credential delegation and proxy-side Kerberos support.

If the proxy advertises both Negotiate and NTLM, verify that application policy chooses the intended explicit scheme. “Any authentication” settings may produce behavior that differs from a strict Negotiate configuration.

If failures occur only on reused connections, inspect pool ownership and gateway affinity. If they occur only after a gateway rotates, confirm that every endpoint has the correct service principal and key material.

Define safe rollout gates

A practical rollout gate can require:

• 100% Kerberos success for identities and gateways intended to use Negotiate;
• zero unapproved NTLM use;
• no identity crossover in connection pools;
• bounded 407 rounds and retries;
• stable p95 authentication latency;
• no direct fallback when the proxy is mandatory;
• complete, secret-free audit evidence;
• a tested rollback for business-critical clients.

Roll out to a small worker cohort first. Monitor proxy 407 rates, successful authentication scheme, ticket errors, connection churn, retry amplification, validated request rate and cost per successful business action.

Upgrade checklist

• [ ] Runtime curl and libcurl versions are recorded.
• [ ] Proxy Negotiate and explicit NTLM configurations are inventoried.
• [ ] The intended Kerberos-only or legacy-exception policy is documented.
• [ ] Gateway service principals and DNS names are verified.
• [ ] Valid, expired and missing-ticket cases are tested.
• [ ] Proxy 407 and origin 401 are reported separately.
• [ ] First-use, reuse, concurrency and failover paths are covered.
• [ ] No credential, token or ticket contents enter logs.
• [ ] Retry limits prevent authentication storms.
• [ ] No mandatory-proxy workflow silently connects directly.
• [ ] Canary thresholds and rollback criteria are approved.

FAQ

Did curl 8.22 remove NTLM support?

No. The release note specifically says NTLM fallback is blocked inside SPNEGO negotiation. Explicit NTLM is a separate configuration and should be governed by organizational policy.

Will every proxy using --proxy-negotiate fail?

No. Correct Kerberos/SPNEGO deployments should continue to be tested for success. Environments that relied on fallback or have incomplete Kerberos prerequisites are more likely to surface failures.

Is a new 407 proof that the proxy provider is broken?

No. It may reveal a client-policy change, missing ticket, principal mismatch, DNS issue or gateway inconsistency. Compare controlled pre- and post-upgrade traces before assigning cause.

Should retries switch to another proxy exit?

Not automatically. An authentication-policy failure usually follows the identity or configuration, so exit rotation can amplify the problem without fixing it. Retry only known transient conditions within a strict budget.

Source note: curl project, “Changes in 8.22.0,” released 2 September 2026; entry “spnego: block NTLM fallback in SPNEGO negotiation.” External source locations are retained only in the internal operations record.

Use proxy infrastructure and enterprise credentials only with explicit authorization. Follow identity, access-control, privacy and logging policies. Never weaken authentication or enable legacy mechanisms merely to make a test pass.