CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

Published

2026-10-20

Modified

2026-10-22

Record from

the NVD, synced 2026-10-23

References

• https://curl.se/docs/CVE-2026-86415.html
• https://curl.se/docs/CVE-2026-86415.json
• https://hackerone.com/reports/3993870

Check your stackJSON