Detections
Analytics
CVE-2026-86415
high
Description
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
References
https://hackerone.com/reports/3993870
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105307