{"id":"CVE-2026-86411","kind":"vulnerability","aliases":["CVE-2026-86411"],"related":[],"title":"curl: pooled FTP connection reuse keeps a prior client certificate identity","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity.","summary":"An ftp:// transfer set to CURLUSESSL_NONE can reuse a pooled FTP control connection that an earlier handle upgraded with STARTTLS and authenticated with a client certificate. The reused connection carries that earlier certificate identity, so the server authorizes the second transfer under credentials it never presented.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","client-certificates","ftp","libcurl","package","php","python"],"not_affected_if":["no-client-certificates","no-ftp","single-handle"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:36+00:00","updated_at":"2026-10-25T05:04:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"curl: pooled FTP connection reuse keeps a prior client certificate identity","impact":"medium","summary":"An ftp:// transfer set to CURLUSESSL_NONE can reuse a pooled FTP control connection that an earlier handle upgraded with STARTTLS and authenticated with a client certificate. The reused connection carries that earlier certificate identity, so the server authorizes the second transfer under credentials it never presented.","category":"package","nicknames":[],"who_cares":["libcurl","ftp","client-certificates","c","python","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"second transfer runs under another client's certificate identity on the server","analyst_note":"Check the curl security advisory and the fixed libcurl version for CVE-2026-86411 at the NVD link; sources give no affected or fixed versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ftp","no-client-certificates","single-handle"],"who_is_affected":"Applications that use libcurl in one process to run several FTP transfers on a shared connection pool, where some transfers use STARTTLS with client certificates and others use CURLUSESSL_NONE. Single-handle programs and programs that never use client-certificate FTP are unlikely to be exposed. unknown whether the sources name specific libcurl versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3343,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86411':14A,17A 'authent':48B,95C 'author':64B,119C 'c':18B 'carri':56B 'certif':10A,21B,52B,59B,99C,126C 'client':9A,20B,51B,98C 'client-certif':19B 'configur':75C 'connect':4A,39B,55B,85C 'continu':117C 'control':38B,84C 'credenti':69B 'curl':1A 'curlusessl':31B,77C 'cve':12A,15A 'earlier':42B,58B 'easi':89C 'first':123C 'ftp':3A,22B,37B,83C,112C 'handl':43B,90C,102C,124C 'handshak':108C 'ident':11A,60B,127C 'keep':6A 'libcurl':23B 'login':113C 'neither':104C 'never':71B 'new':106C,111C 'none':32B,78C 'packag':24B 'perform':103C 'php':25B 'pool':2A,36B,82C 'present':72B 'previous':88C 'prior':8A 'python':26B 'reus':5A,34B,54B,80C 'second':66B,101C 'server':63B,116C 'set':29B 'starttl':46B,93C 'tls':107C 'transfer':28B,67B,74C 'upgrad':44B,91C 'use':96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl in one process to run several FTP transfers on a shared connection pool, where some transfers use STARTTLS with client certificates and others use CURLUSESSL_NONE. Single-handle programs and programs that never use client-certificate FTP are unlikely to be exposed. unknown whether the sources name specific libcurl versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","severity":null,"published_at":"2026-10-20T20:17:25+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}