CVE-2026-86415: auto client cert connection reuse mixup
auto client cert connection reuse mixup
Other sources
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.23.0-1
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue affects libcurl when using Schannel and automatic client certificate selection. It requires reuse of a cached connection that has already been authenticated with a client certificate.
What conditions are required for exploitation?
A transfer must be redirected to a different origin after a cached Schannel connection was authenticated using the automatic client certificate option. The connection cache can then supply that authenticated connection even though automatic client certificate use was disabled for the redirected transfer.
What is the practical impact of a successful exploit?
A redirected transfer can be performed over a reused connection that is already authenticated with a client certificate for another origin. This can cause client-certificate-authenticated connection reuse across origins.