{"id":"CVE-2026-86415","kind":"vulnerability","aliases":["CVE-2026-86415"],"related":[],"title":"libcurl: cached Schannel connection reused across redirects, leaking client certificate","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this.","summary":"libcurl's connection cache matching ignores the automatic client certificate setting, so a cached Schannel connection that already presented a client certificate can be reused for a redirected transfer to a different origin. The attacker gets the authenticated connection's access on a server they should not reach, and the client certificate may be exposed to that server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["client-certificates","libcurl","package","schannel","windows"],"not_affected_if":["no-client-certificates","non-schnannel-backend"],"how_to_check":"- Run `curl --version` and check whether the build uses Schannel (the Windows TLS backend) rather than OpenSSL or another backend\n- Check whether the application's libcurl is linked dynamically or bundled: look for `libcurl` DLLs or the library version reported by the application\n- unknown: the sources do not give the fixed or affected version range","fix":"- Update libcurl to a release that includes the fix for this CVE; the sources do not name the fixed version, so check the curl project's security advisory\n- Until patched, avoid reusing connections with client certificates across redirects in code that uses libcurl with Schannel","status":"open","published_at":"2026-10-20T21:17:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:33+00:00","updated_at":"2026-10-25T05:04:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update libcurl to a release that includes the fix for this CVE; the sources do not name the fixed version, so check the curl project's security advisory\n- Until patched, avoid reusing connections with client certificates across redirects in code that uses libcurl with Schannel","reach":"network","title":"libcurl: cached Schannel connection reused across redirects, leaking client certificate","impact":"medium","summary":"libcurl's connection cache matching ignores the automatic client certificate setting, so a cached Schannel connection that already presented a client certificate can be reused for a redirected transfer to a different origin. The attacker gets the authenticated connection's access on a server they should not reach, and the client certificate may be exposed to that server.","category":"package","nicknames":[],"who_cares":["libcurl","windows","schannel","client-certificates"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Client certificate and authenticated connection reused on another origin","analyst_note":"Confirm affected libcurl versions and the fixed release from the curl security advisory for CVE-2026-86415; the NVD entry gave no version range.","how_to_check":"- Run `curl --version` and check whether the build uses Schannel (the Windows TLS backend) rather than OpenSSL or another backend\n- Check whether the application's libcurl is linked dynamically or bundled: look for `libcurl` DLLs or the library version reported by the application\n- unknown: the sources do not give the fixed or affected version range","needs_analyst":true,"not_affected_if":["non-schnannel-backend","no-client-certificates"],"who_is_affected":"Applications that use libcurl built with the Schannel TLS backend, typically on Windows, and that make requests with client certificates that can follow redirects to other hosts. Systems using OpenSSL, GnuTLS or other backends, and transfers that never send a client certificate, are likely not affected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":3298,"output_tokens":695,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86415':13A,16A 'access':64B 'across':6A 'alreadi':41B,98C 'attack':58B 'authent':61B,99C 'auto':123C 'automat':31B,91C 'cach':2A,27B,37B,85C,97C 'cert':125C 'certif':10A,19B,33B,45B,75B,93C 'client':9A,18B,32B,44B,74B,92C,124C 'client-certif':17B 'code':118C 'connect':4A,26B,39B,62B,84C,101C 'consid':89C 'cve':11A,14A 'differ':55B,113C 'even':115C 'exact':132C 'explicit':119C 'expos':78B 'function':87C 'get':59B 'got':109C 'hand':104C 'ignor':29B 'leak':8A 'libcurl':1A,20B,24B,82C 'match':28B,86C 'may':76B 'never':88C 'option':94C,126C 'origin':56B,114C 'packag':21B 'present':42B 'prevent':131C 'reach':71B 'redirect':7A,51B,110C 'reus':5A,48B 'schannel':3A,22B,38B,100C 'server':67B,81B 'set':34B 'switch':120C 'though':116C 'transfer':52B,107C,129C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl built with the Schannel TLS backend, typically on Windows, and that make requests with client certificates that can follow redirects to other hosts. Systems using OpenSSL, GnuTLS or other backends, and transfers that never send a client certificate, are likely not affected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","severity":null,"published_at":"2026-10-20T21:17:20+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}