Live › vulnerability › CVE-2026-86415
Go to dashboardlibcurl's connection cache matching ignores the automatic client certificate setting, so a cached Schannel connection that already presented a client certificate can be reused for a redirected transfer to a different origin. The attacker gets the authenticated connection's access on a server they should not reach, and the client certificate may be exposed to that server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl built with the Schannel TLS backend, typically on Windows, and that make requests with client certificates that can follow redirects to other hosts. Systems using OpenSSL, GnuTLS or other backends, and transfers that never send a client certificate, are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
curl --version and check whether the build uses Schannel (the Windows TLS backend) rather than OpenSSL or another backendlibcurl DLLs or the library version reported by the applicationEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
This page as .md · .json · in your agent: get_signal("CVE-2026-86415")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.