Live › vulnerability › CVE-2026-86411
Go to dashboardAn ftp:// transfer set to CURLUSESSL_NONE can reuse a pooled FTP control connection that an earlier handle upgraded with STARTTLS and authenticated with a client certificate. The reused connection carries that earlier certificate identity, so the server authorizes the second transfer under credentials it never presented.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl in one process to run several FTP transfers on a shared connection pool, where some transfers use STARTTLS with client certificates and others use CURLUSESSL_NONE. Single-handle programs and programs that never use client-certificate FTP are unlikely to be exposed. unknown whether the sources name specific libcurl versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP
control connection that a previous easy handle upgraded with STARTTLS and
authenticated using a client certificate. The second handle performs neither a
new TLS handshake nor a new FTP login, so the server continues to authorize it
under the first handle's certificate identity.
This page as .md · .json · in your agent: get_signal("CVE-2026-86411")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.