What’s Vulnerable › Vulnerabilities

CVE-2026-86415: auto client cert connection reuse mixup

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-30
• Weakness: CWE-201

Description

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

Affected products

• curl: from 8.22.0 through 8.22.0; from 8.21.0 through 8.21.0

References

• https://curl.se/docs/CVE-2026-86415.html
• https://curl.se/docs/CVE-2026-86415.json
• https://hackerone.com/reports/3993870

Get alerted when CVE-2026-86415 or the next vulnerability affects your stack