CVE-2026-86415

Not enough EPSS history yet.

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

• curl.sehttps://curl.se/docs/CVE-2026-86415.html
• curl.sehttps://curl.se/docs/CVE-2026-86415.json
• hackerone.comhttps://hackerone.com/reports/3993870

No related CVEs by CWE or product.