CVE-2026-86411: FTP connection reuse inherits client-certificate

Published Oct 20, 2026

Updated

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Affected Software

1 affected component

curl libcurl

Event History

Oct 20, 2026

CVE Published

via MITRE·08:02 PM

Data Sourced

via MITRE·08:02 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

Who is exposed to this connection-reuse issue?

Applications using libcurl connection pooling are exposed when one easy handle upgrades an FTP control connection with STARTTLS and authenticates with a client certificate, then another handle requests ftp:// with CURLUSESSL_NONE and reuses that pooled connection.

What must an attacker or unintended caller be able to do to trigger the identity mix-up?

They need to cause or obtain use of a pooled FTP control connection previously authenticated with a client certificate, followed by an FTP transfer configured with CURLUSESSL_NONE. The second transfer does not perform a new TLS handshake or FTP login, so it is authorized as the prior certificate identity.

Is a non-TLS FTP configuration sufficient to avoid the issue?

No. The affected second transfer is explicitly configured with CURLUSESSL_NONE; the issue occurs when it reuses a control connection that an earlier handle upgraded with STARTTLS and authenticated using a client certificate.

How can an application determine whether it may be affected?

Review whether it shares libcurl's connection pool across easy handles that mix FTP transfers using client-certificate STARTTLS with transfers configured using CURLUSESSL_NONE. Affected behavior requires reuse of the earlier authenticated FTP control connection rather than establishing a new connection and login.

CVE-2026-86411: FTP connection reuse inherits client-certificate

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this connection-reuse issue?

What must an attacker or unintended caller be able to do to trigger the identity mix-up?

Is a non-TLS FTP configuration sufficient to avoid the issue?

How can an application determine whether it may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this connection-reuse issue?

What must an attacker or unintended caller be able to do to trigger the identity mix-up?

Is a non-TLS FTP configuration sufficient to avoid the issue?

How can an application determine whether it may be affected?