CVE-2026-86415 - Vulnerability Details - OpenCVE

A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security (TLS) backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different destination, causing curl to inappropriately reuse an already authenticated connection. This issue can result in information disclosure by exposing client certificates and credentials to unintended origins.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-86415
https://www.cve.org/CVERecord?id=CVE-2026-86415

History

Sat, 17 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security (TLS) backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different destination, causing curl to inappropriately reuse an already authenticated connection. This issue can result in information disclosure by exposing client certificates and credentials to unintended origins.
Title		curl: curl: auto client cert connection reuse mixup
Weaknesses		CWE-201
References		https://nvd.nist.gov/vuln/detail/CVE-2026-86415 https://www.cve.org/CVERecord?id=CVE-2026-86415
Metrics	threat_severity `None`	cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Low`

Projects

Sign in to view the affected projects.

MITRE

No data.

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-10-14T12:00:00Z

Links: CVE-2026-86415 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-17T02:00:07Z

Weaknesses

CWE-201

{"acknowledgement": "Red Hat would like to thank Stanislav Fort (Aisle Research) for reporting this issue.", "bugzilla": {"description": "curl: curl: auto client cert connection reuse mixup", "id": "2550604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550604"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security (TLS) backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different destination, causing curl to inappropriately reuse an already authenticated connection. This issue can result in information disclosure by exposing client certificates and credentials to unintended origins."], "name": "CVE-2026-86415", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Not affected", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86415\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86415"], "statement": "This vulnerability is rated as Low impact for Red Hat products because exploitation is restricted to builds utilizing the Windows-specific Schannel TLS backend. Red Hat distributions compile curl and libcurl with OpenSSL rather than Schannel. As a result, the vulnerable code paths are not present or active in Red Hat environments.", "threat_severity": "Low"}