new file mode 100644
@@ -0,0 +1,102 @@
+From 6ae9befb2fb6bdfdb5fc11fdf76bbe519fe1f52c Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 5 Sep 2026 15:55:58 +0200
+Subject: [PATCH] config2setopts: always set the security options for SCP/SFTP
+
+If the protocols are built-in
+
+Closes #22839
+
+CVE: CVE-2026-86410
+Upstream-Status: Backport [https://github.com/curl/curl/commit/6ae9befb2fb6bdfdb5fc11fdf76bbe519fe1f52c]
+
+Backport Changes:
+- Use curl 8.19.0's directly owned findfile() result. Add the
+ missing-file fallback when that result is NULL; upstream places
+ it after a newer temporary-path copy branch.
+- Omit test1679's stripfile update. Test1679 and data1679.c were
+ introduced by [1] after curl 8.19.0 and are absent here. They check
+ SSL option resets across --next in generated --libcurl output.
+ The omitted line only strips CURLOPT_SSH_KNOWNHOSTS from that
+ comparison; it does not exercise SSH redirects.
+ Existing --libcurl tests already filter that option.
+
+[1] https://github.com/curl/curl/commit/19d0f4acfa9df373e8e1f987c11b7165e1edac34
+
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ src/config2setopts.c | 34 +++++++++++++++++++++++-----------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/src/config2setopts.c b/src/config2setopts.c
+index 20d87a0..27ca721 100644
+--- a/src/config2setopts.c
++++ b/src/config2setopts.c
+@@ -178,12 +178,11 @@ static CURLcode url_proto_and_rewrite(char **url,
+ return result;
+ }
+
+-static CURLcode ssh_setopts(struct OperationConfig *config, CURL *curl,
+- const char *use_proto)
++static CURLcode ssh_setopts(struct OperationConfig *config, CURL *curl)
+ {
+ CURLcode result;
+
+- if(use_proto != proto_scp && use_proto != proto_sftp)
++ if(!proto_scp && !proto_sftp)
+ return CURLE_OK;
+
+ /* SSH and SSL private key uses same command-line option */
+@@ -204,8 +203,27 @@ static CURLcode ssh_setopts(struct OperationConfig *config, CURL *curl,
+
+ if(!config->insecure_ok) {
+ char *known = config->knownhosts;
+- if(!known)
++ if(!known) {
+ known = findfile(".ssh/known_hosts", FALSE);
++ if(!known && !config->hostpubmd5 && !config->hostpubsha256) {
++ /* couldn't find an existing one, instead set one that MIGHT work as
++ we don't verify the host using other means */
++ struct dynbuf k;
++ char *home = getenv("HOME");
++ curlx_dyn_init(&k, 256);
++
++ /* If the HOME environment variable is missing this renders a path
++ that is likely to not work but the HOME one also does not exist!
++ */
++ result = curlx_dyn_addf(&k,
++ "%s" DIR_CHAR ".ssh" DIR_CHAR "known_hosts",
++ home ? home : "");
++ if(result)
++ return result;
++ known = curlx_dyn_ptr(&k);
++ }
++ }
++
+ if(known) {
+ result = my_setopt_str(curl, CURLOPT_SSH_KNOWNHOSTS, known);
+ if(result) {
+@@ -216,12 +234,6 @@ static CURLcode ssh_setopts(struct OperationConfig *config, CURL *curl,
+ /* store it in global to avoid repeated checks */
+ config->knownhosts = known;
+ }
+- else if(!config->hostpubmd5 && !config->hostpubsha256) {
+- errorf("Could not find a known_hosts file");
+- return CURLE_FAILED_INIT;
+- }
+- else
+- warnf("Could not find a known_hosts file");
+ }
+ return CURLE_OK; /* ignore if SHA256 did not work */
+ }
+@@ -928,7 +940,7 @@ CURLcode config2setopts(struct OperationConfig *config,
+ MY_SETOPT_STR(curl, CURLOPT_KEYPASSWD, config->key_passwd);
+ MY_SETOPT_STR(curl, CURLOPT_PROXY_KEYPASSWD, config->proxy_key_passwd);
+
+- result = ssh_setopts(config, curl, use_proto);
++ result = ssh_setopts(config, curl);
+ if(setopt_bad(result))
+ return result;
+
+--
+2.35.6
@@ -62,6 +62,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-87865_p2.patch \
file://CVE-2026-92391.patch \
file://CVE-2026-87863.patch \
+ file://CVE-2026-86410.patch \
"
SRC_URI:append:class-nativesdk = " \